Grsec/PaX: 2.9.1-{2.6.32.59,3.2.30,3.5.6}-20121007171620121007

13 files changed, 67 insertions, 10651 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 42845f1..05a4857 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch:	1058_linux-2.6.32.59.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.59-201210070827.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210070827.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch
index d90002f..3166836 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210070827.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201210071703.patch
@@ -75693,10 +75693,18 @@ index 9fe7d7e..cdb62c9 100644
  
  	seq_putc(m, '\n');
 diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
-index 04d1270..ca49aa3 100644
+index 04d1270..9dbd384 100644
 --- a/fs/proc/proc_net.c
 +++ b/fs/proc/proc_net.c
-@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(struct inode *dir)
+@@ -22,6 +22,7 @@
+ #include <linux/nsproxy.h>
+ #include <net/net_namespace.h>
+ #include <linux/seq_file.h>
++#include <linux/grsecurity.h>
+ 
+ #include "internal.h"
+ 
+@@ -104,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
  	struct task_struct *task;
  	struct nsproxy *ns;
  	struct net *net = NULL;
diff --git a/3.2.30/0000_README b/3.2.30/0000_README
index 69b9c98..ed17ee7 100644
--- a/3.2.30/0000_README
+++ b/3.2.30/0000_README
@@ -38,7 +38,7 @@ Patch:	1029_linux-3.2.30.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.30
 
-Patch:	4420_grsecurity-2.9.1-3.2.30-201210070828.patch
+Patch:	4420_grsecurity-2.9.1-3.2.30-201210071704.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.30/4420_grsecurity-2.9.1-3.2.30-201210070828.patch b/3.2.30/4420_grsecurity-2.9.1-3.2.30-201210071704.patch
index 431e878..b87e134 100644
--- a/3.2.30/4420_grsecurity-2.9.1-3.2.30-201210070828.patch
+++ b/3.2.30/4420_grsecurity-2.9.1-3.2.30-201210071704.patch
@@ -50207,10 +50207,18 @@ index b1822dd..df622cb 100644
  
  	seq_putc(m, '\n');
 diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
-index f738024..8e3f141 100644
+index f738024..682f400 100644
 --- a/fs/proc/proc_net.c
 +++ b/fs/proc/proc_net.c
-@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
+@@ -23,6 +23,7 @@
+ #include <linux/nsproxy.h>
+ #include <net/net_namespace.h>
+ #include <linux/seq_file.h>
++#include <linux/grsecurity.h>
+ 
+ #include "internal.h"
+ 
+@@ -105,6 +106,17 @@ static struct net *get_proc_task_net(struct inode *dir)
  	struct task_struct *task;
  	struct nsproxy *ns;
  	struct net *net = NULL;
diff --git a/3.5.5/1004_linux-3.5.5.patch b/3.5.5/1004_linux-3.5.5.patch
deleted file mode 100644
index d3f2056..0000000
--- a/3.5.5/1004_linux-3.5.5.patch
+++ /dev/null
@@ -1,10564 +0,0 @@
-diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
-index 286ec04..82dd174 100644
---- a/Documentation/sound/alsa/HD-Audio-Models.txt
-+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
-@@ -47,6 +47,7 @@ ALC882/883/885/888/889
-   acer-aspire-4930g	Acer Aspire 4930G/5930G/6530G/6930G/7730G
-   acer-aspire-8930g	Acer Aspire 8330G/6935G
-   acer-aspire		Acer Aspire others
-+  no-primary-hp		VAIO Z workaround (for fixed speaker DAC)
- 
- ALC861/660
- ==========
-diff --git a/Makefile b/Makefile
-index 6453ead..b3dfc85 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 5
--SUBLEVEL = 4
-+SUBLEVEL = 5
- EXTRAVERSION =
- NAME = Saber-toothed Squirrel
- 
-diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
-index 3bb7ffe..c2cbe4f 100644
---- a/arch/alpha/include/asm/atomic.h
-+++ b/arch/alpha/include/asm/atomic.h
-@@ -14,8 +14,8 @@
-  */
- 
- 
--#define ATOMIC_INIT(i)		( (atomic_t) { (i) } )
--#define ATOMIC64_INIT(i)	( (atomic64_t) { (i) } )
-+#define ATOMIC_INIT(i)		{ (i) }
-+#define ATOMIC64_INIT(i)	{ (i) }
- 
- #define atomic_read(v)		(*(volatile int *)&(v)->counter)
- #define atomic64_read(v)	(*(volatile long *)&(v)->counter)
-diff --git a/arch/arm/Makefile b/arch/arm/Makefile
-index 0298b00..926d840 100644
---- a/arch/arm/Makefile
-+++ b/arch/arm/Makefile
-@@ -279,10 +279,10 @@ zImage Image xipImage bootpImage uImage: vmlinux
- zinstall uinstall install: vmlinux
- 	$(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
- 
--%.dtb:
-+%.dtb: scripts
- 	$(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
- 
--dtbs:
-+dtbs: scripts
- 	$(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
- 
- # We use MRPROPER_FILES and CLEAN_FILES now
-diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
-index b8c64b8..bc67cbf 100644
---- a/arch/arm/boot/compressed/head.S
-+++ b/arch/arm/boot/compressed/head.S
-@@ -653,16 +653,21 @@ __armv7_mmu_cache_on:
- 		mcrne	p15, 0, r0, c8, c7, 0	@ flush I,D TLBs
- #endif
- 		mrc	p15, 0, r0, c1, c0, 0	@ read control reg
-+		bic	r0, r0, #1 << 28	@ clear SCTLR.TRE
- 		orr	r0, r0, #0x5000		@ I-cache enable, RR cache replacement
- 		orr	r0, r0, #0x003c		@ write buffer
- #ifdef CONFIG_MMU
- #ifdef CONFIG_CPU_ENDIAN_BE8
- 		orr	r0, r0, #1 << 25	@ big-endian page tables
- #endif
-+		mrcne   p15, 0, r6, c2, c0, 2   @ read ttb control reg
- 		orrne	r0, r0, #1		@ MMU enabled
- 		movne	r1, #0xfffffffd		@ domain 0 = client
-+		bic     r6, r6, #1 << 31        @ 32-bit translation system
-+		bic     r6, r6, #3 << 0         @ use only ttbr0
- 		mcrne	p15, 0, r3, c2, c0, 0	@ load page table pointer
- 		mcrne	p15, 0, r1, c3, c0, 0	@ load domain access control
-+		mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
- #endif
- 		mcr	p15, 0, r0, c7, c5, 4	@ ISB
- 		mcr	p15, 0, r0, c1, c0, 0	@ load control register
-diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
-index 03fb936..5c8b3bf4 100644
---- a/arch/arm/include/asm/assembler.h
-+++ b/arch/arm/include/asm/assembler.h
-@@ -320,4 +320,12 @@
- 	.size \name , . - \name
- 	.endm
- 
-+	.macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
-+#ifndef CONFIG_CPU_USE_DOMAINS
-+	adds	\tmp, \addr, #\size - 1
-+	sbcccs	\tmp, \tmp, \limit
-+	bcs	\bad
-+#endif
-+	.endm
-+
- #endif /* __ASM_ASSEMBLER_H__ */
-diff --git a/arch/arm/include/asm/mutex.h b/arch/arm/include/asm/mutex.h
-index 93226cf..b1479fd 100644
---- a/arch/arm/include/asm/mutex.h
-+++ b/arch/arm/include/asm/mutex.h
-@@ -7,121 +7,10 @@
-  */
- #ifndef _ASM_MUTEX_H
- #define _ASM_MUTEX_H
--
--#if __LINUX_ARM_ARCH__ < 6
--/* On pre-ARMv6 hardware the swp based implementation is the most efficient. */
--# include <asm-generic/mutex-xchg.h>
--#else
--
- /*
-- * Attempting to lock a mutex on ARMv6+ can be done with a bastardized
-- * atomic decrement (it is not a reliable atomic decrement but it satisfies
-- * the defined semantics for our purpose, while being smaller and faster
-- * than a real atomic decrement or atomic swap.  The idea is to attempt
-- * decrementing the lock value only once.  If once decremented it isn't zero,
-- * or if its store-back fails due to a dispute on the exclusive store, we
-- * simply bail out immediately through the slow path where the lock will be
-- * reattempted until it succeeds.
-+ * On pre-ARMv6 hardware this results in a swp-based implementation,
-+ * which is the most efficient. For ARMv6+, we emit a pair of exclusive
-+ * accesses instead.
-  */
--static inline void
--__mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
--{
--	int __ex_flag, __res;
--
--	__asm__ (
--
--		"ldrex	%0, [%2]	\n\t"
--		"sub	%0, %0, #1	\n\t"
--		"strex	%1, %0, [%2]	"
--
--		: "=&r" (__res), "=&r" (__ex_flag)
--		: "r" (&(count)->counter)
--		: "cc","memory" );
--
--	__res |= __ex_flag;
--	if (unlikely(__res != 0))
--		fail_fn(count);
--}
--
--static inline int
--__mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
--{
--	int __ex_flag, __res;
--
--	__asm__ (
--
--		"ldrex	%0, [%2]	\n\t"
--		"sub	%0, %0, #1	\n\t"
--		"strex	%1, %0, [%2]	"
--
--		: "=&r" (__res), "=&r" (__ex_flag)
--		: "r" (&(count)->counter)
--		: "cc","memory" );
--
--	__res |= __ex_flag;
--	if (unlikely(__res != 0))
--		__res = fail_fn(count);
--	return __res;
--}
--
--/*
-- * Same trick is used for the unlock fast path. However the original value,
-- * rather than the result, is used to test for success in order to have
-- * better generated assembly.
-- */
--static inline void
--__mutex_fastpath_unlock(atomic_t *count, void (*fail_fn)(atomic_t *))
--{
--	int __ex_flag, __res, __orig;
--
--	__asm__ (
--
--		"ldrex	%0, [%3]	\n\t"
--		"add	%1, %0, #1	\n\t"
--		"strex	%2, %1, [%3]	"
--
--		: "=&r" (__orig), "=&r" (__res), "=&r" (__ex_flag)
--		: "r" (&(count)->counter)
--		: "cc","memory" );
--
--	__orig |= __ex_flag;
--	if (unlikely(__orig != 0))
--		fail_fn(count);
--}
--
--/*
-- * If the unlock was done on a contended lock, or if the unlock simply fails
-- * then the mutex remains locked.
-- */
--#define __mutex_slowpath_needs_to_unlock()	1
--
--/*
-- * For __mutex_fastpath_trylock we use another construct which could be
-- * described as a "single value cmpxchg".
-- *
-- * This provides the needed trylock semantics like cmpxchg would, but it is
-- * lighter and less generic than a true cmpxchg implementation.
-- */
--static inline int
--__mutex_fastpath_trylock(atomic_t *count, int (*fail_fn)(atomic_t *))
--{
--	int __ex_flag, __res, __orig;
--
--	__asm__ (
--
--		"1: ldrex	%0, [%3]	\n\t"
--		"subs		%1, %0, #1	\n\t"
--		"strexeq	%2, %1, [%3]	\n\t"
--		"movlt		%0, #0		\n\t"
--		"cmpeq		%2, #0		\n\t"
--		"bgt		1b		"
--
--		: "=&r" (__orig), "=&r" (__res), "=&r" (__ex_flag)
--		: "r" (&count->counter)
--		: "cc", "memory" );
--
--	return __orig;
--}
--
--#endif
-+#include <asm-generic/mutex-xchg.h>
- #endif
-diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 71f6536..0a070e9 100644
---- a/arch/arm/include/asm/uaccess.h
-+++ b/arch/arm/include/asm/uaccess.h
-@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
- extern int __get_user_2(void *);
- extern int __get_user_4(void *);
- 
--#define __get_user_x(__r2,__p,__e,__s,__i...)				\
-+#define __GUP_CLOBBER_1	"lr", "cc"
-+#ifdef CONFIG_CPU_USE_DOMAINS
-+#define __GUP_CLOBBER_2	"ip", "lr", "cc"
-+#else
-+#define __GUP_CLOBBER_2 "lr", "cc"
-+#endif
-+#define __GUP_CLOBBER_4	"lr", "cc"
-+
-+#define __get_user_x(__r2,__p,__e,__l,__s)				\
- 	   __asm__ __volatile__ (					\
- 		__asmeq("%0", "r0") __asmeq("%1", "r2")			\
-+		__asmeq("%3", "r1")					\
- 		"bl	__get_user_" #__s				\
- 		: "=&r" (__e), "=r" (__r2)				\
--		: "0" (__p)						\
--		: __i, "cc")
-+		: "0" (__p), "r" (__l)					\
-+		: __GUP_CLOBBER_##__s)
- 
- #define get_user(x,p)							\
- 	({								\
-+		unsigned long __limit = current_thread_info()->addr_limit - 1; \
- 		register const typeof(*(p)) __user *__p asm("r0") = (p);\
- 		register unsigned long __r2 asm("r2");			\
-+		register unsigned long __l asm("r1") = __limit;		\
- 		register int __e asm("r0");				\
- 		switch (sizeof(*(__p))) {				\
- 		case 1:							\
--			__get_user_x(__r2, __p, __e, 1, "lr");		\
--	       		break;						\
-+			__get_user_x(__r2, __p, __e, __l, 1);		\
-+			break;						\
- 		case 2:							\
--			__get_user_x(__r2, __p, __e, 2, "r3", "lr");	\
-+			__get_user_x(__r2, __p, __e, __l, 2);		\
- 			break;						\
- 		case 4:							\
--	       		__get_user_x(__r2, __p, __e, 4, "lr");		\
-+			__get_user_x(__r2, __p, __e, __l, 4);		\
- 			break;						\
- 		default: __e = __get_user_bad(); break;			\
- 		}							\
-@@ -135,31 +146,34 @@ extern int __put_user_2(void *, unsigned int);
- extern int __put_user_4(void *, unsigned int);
- extern int __put_user_8(void *, unsigned long long);
- 
--#define __put_user_x(__r2,__p,__e,__s)					\
-+#define __put_user_x(__r2,__p,__e,__l,__s)				\
- 	   __asm__ __volatile__ (					\
- 		__asmeq("%0", "r0") __asmeq("%2", "r2")			\
-+		__asmeq("%3", "r1")					\
- 		"bl	__put_user_" #__s				\
- 		: "=&r" (__e)						\
--		: "0" (__p), "r" (__r2)					\
-+		: "0" (__p), "r" (__r2), "r" (__l)			\
- 		: "ip", "lr", "cc")
- 
- #define put_user(x,p)							\
- 	({								\
-+		unsigned long __limit = current_thread_info()->addr_limit - 1; \
- 		register const typeof(*(p)) __r2 asm("r2") = (x);	\
- 		register const typeof(*(p)) __user *__p asm("r0") = (p);\
-+		register unsigned long __l asm("r1") = __limit;		\
- 		register int __e asm("r0");				\
- 		switch (sizeof(*(__p))) {				\
- 		case 1:							\
--			__put_user_x(__r2, __p, __e, 1);		\
-+			__put_user_x(__r2, __p, __e, __l, 1);		\
- 			break;						\
- 		case 2:							\
--			__put_user_x(__r2, __p, __e, 2);		\
-+			__put_user_x(__r2, __p, __e, __l, 2);		\
- 			break;						\
- 		case 4:							\
--			__put_user_x(__r2, __p, __e, 4);		\
-+			__put_user_x(__r2, __p, __e, __l, 4);		\
- 			break;						\
- 		case 8:							\
--			__put_user_x(__r2, __p, __e, 8);		\
-+			__put_user_x(__r2, __p, __e, __l, 8);		\
- 			break;						\
- 		default: __e = __put_user_bad(); break;			\
- 		}							\
-diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
-index ba386bd..18d39ea 100644
---- a/arch/arm/kernel/hw_breakpoint.c
-+++ b/arch/arm/kernel/hw_breakpoint.c
-@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
- 		arch >= ARM_DEBUG_ARCH_V7_1;
- }
- 
-+/* Can we determine the watchpoint access type from the fsr? */
-+static int debug_exception_updates_fsr(void)
-+{
-+	return 0;
-+}
-+
- /* Determine number of WRP registers available. */
- static int get_num_wrp_resources(void)
- {
-@@ -619,18 +625,35 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
- 	info->address &= ~alignment_mask;
- 	info->ctrl.len <<= offset;
- 
--	/*
--	 * Currently we rely on an overflow handler to take
--	 * care of single-stepping the breakpoint when it fires.
--	 * In the case of userspace breakpoints on a core with V7 debug,
--	 * we can use the mismatch feature as a poor-man's hardware
--	 * single-step, but this only works for per-task breakpoints.
--	 */
--	if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
--	    !core_has_mismatch_brps() || !bp->hw.bp_target)) {
--		pr_warning("overflow handler required but none found\n");
--		ret = -EINVAL;
-+	if (!bp->overflow_handler) {
-+		/*
-+		 * Mismatch breakpoints are required for single-stepping
-+		 * breakpoints.
-+		 */
-+		if (!core_has_mismatch_brps())
-+			return -EINVAL;
-+
-+		/* We don't allow mismatch breakpoints in kernel space. */
-+		if (arch_check_bp_in_kernelspace(bp))
-+			return -EPERM;
-+
-+		/*
-+		 * Per-cpu breakpoints are not supported by our stepping
-+		 * mechanism.
-+		 */
-+		if (!bp->hw.bp_target)
-+			return -EINVAL;
-+
-+		/*
-+		 * We only support specific access types if the fsr
-+		 * reports them.
-+		 */
-+		if (!debug_exception_updates_fsr() &&
-+		    (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
-+		     info->ctrl.type == ARM_BREAKPOINT_STORE))
-+			return -EINVAL;
- 	}
-+
- out:
- 	return ret;
- }
-@@ -706,10 +729,12 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
- 				goto unlock;
- 
- 			/* Check that the access type matches. */
--			access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
--				 HW_BREAKPOINT_R;
--			if (!(access & hw_breakpoint_type(wp)))
--				goto unlock;
-+			if (debug_exception_updates_fsr()) {
-+				access = (fsr & ARM_FSR_ACCESS_MASK) ?
-+					  HW_BREAKPOINT_W : HW_BREAKPOINT_R;
-+				if (!(access & hw_breakpoint_type(wp)))
-+					goto unlock;
-+			}
- 
- 			/* We have a winner. */
- 			info->trigger = addr;
-diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index c7cae6b..eeb7520 100644
---- a/arch/arm/kernel/traps.c
-+++ b/arch/arm/kernel/traps.c
-@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
- #endif
- 			instr = *(u32 *) pc;
- 	} else if (thumb_mode(regs)) {
--		get_user(instr, (u16 __user *)pc);
-+		if (get_user(instr, (u16 __user *)pc))
-+			goto die_sig;
- 		if (is_wide_instruction(instr)) {
- 			unsigned int instr2;
--			get_user(instr2, (u16 __user *)pc+1);
-+			if (get_user(instr2, (u16 __user *)pc+1))
-+				goto die_sig;
- 			instr <<= 16;
- 			instr |= instr2;
- 		}
--	} else {
--		get_user(instr, (u32 __user *)pc);
-+	} else if (get_user(instr, (u32 __user *)pc)) {
-+		goto die_sig;
- 	}
- 
- 	if (call_undef_hook(regs, instr) == 0)
- 		return;
- 
-+die_sig:
- #ifdef CONFIG_DEBUG_USER
- 	if (user_debug & UDBG_UNDEFINED) {
- 		printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
-diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
-index 11093a7..9b06bb4 100644
---- a/arch/arm/lib/getuser.S
-+++ b/arch/arm/lib/getuser.S
-@@ -16,8 +16,9 @@
-  * __get_user_X
-  *
-  * Inputs:	r0 contains the address
-+ *		r1 contains the address limit, which must be preserved
-  * Outputs:	r0 is the error code
-- *		r2, r3 contains the zero-extended value
-+ *		r2 contains the zero-extended value
-  *		lr corrupted
-  *
-  * No other registers must be altered.  (see <asm/uaccess.h>
-@@ -27,33 +28,39 @@
-  * Note also that it is intended that __get_user_bad is not global.
-  */
- #include <linux/linkage.h>
-+#include <asm/assembler.h>
- #include <asm/errno.h>
- #include <asm/domain.h>
- 
- ENTRY(__get_user_1)
-+	check_uaccess r0, 1, r1, r2, __get_user_bad
- 1: TUSER(ldrb)	r2, [r0]
- 	mov	r0, #0
- 	mov	pc, lr
- ENDPROC(__get_user_1)
- 
- ENTRY(__get_user_2)
--#ifdef CONFIG_THUMB2_KERNEL
--2: TUSER(ldrb)	r2, [r0]
--3: TUSER(ldrb)	r3, [r0, #1]
-+	check_uaccess r0, 2, r1, r2, __get_user_bad
-+#ifdef CONFIG_CPU_USE_DOMAINS
-+rb	.req	ip
-+2:	ldrbt	r2, [r0], #1
-+3:	ldrbt	rb, [r0], #0
- #else
--2: TUSER(ldrb)	r2, [r0], #1
--3: TUSER(ldrb)	r3, [r0]
-+rb	.req	r0
-+2:	ldrb	r2, [r0]
-+3:	ldrb	rb, [r0, #1]
- #endif
- #ifndef __ARMEB__
--	orr	r2, r2, r3, lsl #8
-+	orr	r2, r2, rb, lsl #8
- #else
--	orr	r2, r3, r2, lsl #8
-+	orr	r2, rb, r2, lsl #8
- #endif
- 	mov	r0, #0
- 	mov	pc, lr
- ENDPROC(__get_user_2)
- 
- ENTRY(__get_user_4)
-+	check_uaccess r0, 4, r1, r2, __get_user_bad
- 4: TUSER(ldr)	r2, [r0]
- 	mov	r0, #0
- 	mov	pc, lr
-diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
-index 7db2599..3d73dcb 100644
---- a/arch/arm/lib/putuser.S
-+++ b/arch/arm/lib/putuser.S
-@@ -16,6 +16,7 @@
-  * __put_user_X
-  *
-  * Inputs:	r0 contains the address
-+ *		r1 contains the address limit, which must be preserved
-  *		r2, r3 contains the value
-  * Outputs:	r0 is the error code
-  *		lr corrupted
-@@ -27,16 +28,19 @@
-  * Note also that it is intended that __put_user_bad is not global.
-  */
- #include <linux/linkage.h>
-+#include <asm/assembler.h>
- #include <asm/errno.h>
- #include <asm/domain.h>
- 
- ENTRY(__put_user_1)
-+	check_uaccess r0, 1, r1, ip, __put_user_bad
- 1: TUSER(strb)	r2, [r0]
- 	mov	r0, #0
- 	mov	pc, lr
- ENDPROC(__put_user_1)
- 
- ENTRY(__put_user_2)
-+	check_uaccess r0, 2, r1, ip, __put_user_bad
- 	mov	ip, r2, lsr #8
- #ifdef CONFIG_THUMB2_KERNEL
- #ifndef __ARMEB__
-@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
- ENDPROC(__put_user_2)
- 
- ENTRY(__put_user_4)
-+	check_uaccess r0, 4, r1, ip, __put_user_bad
- 4: TUSER(str)	r2, [r0]
- 	mov	r0, #0
- 	mov	pc, lr
- ENDPROC(__put_user_4)
- 
- ENTRY(__put_user_8)
-+	check_uaccess r0, 8, r1, ip, __put_user_bad
- #ifdef CONFIG_THUMB2_KERNEL
- 5: TUSER(str)	r2, [r0]
- 6: TUSER(str)	r3, [r0, #4]
-diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
-index fdd8cc8..4431a62 100644
---- a/arch/arm/mach-imx/clk-imx25.c
-+++ b/arch/arm/mach-imx/clk-imx25.c
-@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
- 	clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
- 	clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
- 	clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
--	clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
--	clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
--	clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
--	clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
-+	clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
-+	clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
- 	clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
- 	clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
- 	clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");
-diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
-index c6422fb..65fb8bc 100644
---- a/arch/arm/mach-imx/clk-imx35.c
-+++ b/arch/arm/mach-imx/clk-imx35.c
-@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
- 	clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
- 	clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
- 	clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
--	clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
--	clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
--	clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
--	clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
-+	clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
-+	clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
- 	/* i.mx35 has the i.mx21 type uart */
- 	clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
- 	clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");
-diff --git a/arch/arm/mach-imx/mach-armadillo5x0.c b/arch/arm/mach-imx/mach-armadillo5x0.c
-index c650145..db1f244 100644
---- a/arch/arm/mach-imx/mach-armadillo5x0.c
-+++ b/arch/arm/mach-imx/mach-armadillo5x0.c
-@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(void)
- 	imx31_add_mxc_nand(&armadillo5x0_nand_board_info);
- 
- 	/* set NAND page size to 2k if not configured via boot mode pins */
--	__raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
-+	__raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) |
-+					(1 << 30), mx3_ccm_base + MXC_CCM_RCSR);
- 
- 	/* RTC */
- 	/* Get RTC IRQ and register the chip */
-diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
-index 840929b..2cdbcc7 100644
---- a/arch/arm/mach-omap2/timer.c
-+++ b/arch/arm/mach-omap2/timer.c
-@@ -263,6 +263,7 @@ static u32 notrace dmtimer_read_sched_clock(void)
- 	return 0;
- }
- 
-+#ifdef CONFIG_OMAP_32K_TIMER
- /* Setup free-running counter for clocksource */
- static int __init omap2_sync32k_clocksource_init(void)
- {
-@@ -302,6 +303,12 @@ static int __init omap2_sync32k_clocksource_init(void)
- 
- 	return ret;
- }
-+#else
-+static inline int omap2_sync32k_clocksource_init(void)
-+{
-+	return -ENODEV;
-+}
-+#endif
- 
- static void __init omap2_gptimer_clocksource_init(int gptimer_id,
- 						const char *fck_source)
-diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
-index 2e8a1ef..87fa3f2 100644
---- a/arch/arm/mm/mm.h
-+++ b/arch/arm/mm/mm.h
-@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
- /* permanent static mappings from iotable_init() */
- #define VM_ARM_STATIC_MAPPING	0x40000000
- 
-+/* empty mapping */
-+#define VM_ARM_EMPTY_MAPPING	0x20000000
-+
- /* mapping type (attributes) for permanent static mappings */
- #define VM_ARM_MTYPE(mt)		((mt) << 20)
- #define VM_ARM_MTYPE_MASK	(0x1f << 20)
-diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
-index cf4528d..15c6abe 100644
---- a/arch/arm/mm/mmu.c
-+++ b/arch/arm/mm/mmu.c
-@@ -813,7 +813,7 @@ static void __init pmd_empty_section_gap(unsigned long addr)
- 	vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
- 	vm->addr = (void *)addr;
- 	vm->size = SECTION_SIZE;
--	vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
-+	vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
- 	vm->caller = pmd_empty_section_gap;
- 	vm_area_add_early(vm);
- }
-@@ -826,7 +826,7 @@ static void __init fill_pmd_gaps(void)
- 
- 	/* we're still single threaded hence no lock needed here */
- 	for (vm = vmlist; vm; vm = vm->next) {
--		if (!(vm->flags & VM_ARM_STATIC_MAPPING))
-+		if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
- 			continue;
- 		addr = (unsigned long)vm->addr;
- 		if (addr < next)
-diff --git a/arch/mips/mm/gup.c b/arch/mips/mm/gup.c
-index 33aadbc..dcfd573 100644
---- a/arch/mips/mm/gup.c
-+++ b/arch/mips/mm/gup.c
-@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsigned long addr, unsigned long end,
- 	do {
- 		VM_BUG_ON(compound_head(page) != head);
- 		pages[*nr] = page;
-+		if (PageTail(page))
-+			get_huge_page_tail(page);
- 		(*nr)++;
- 		page++;
- 		refs++;
-diff --git a/arch/powerpc/platforms/85xx/p1022_ds.c b/arch/powerpc/platforms/85xx/p1022_ds.c
-index 978330c..f80887f 100644
---- a/arch/powerpc/platforms/85xx/p1022_ds.c
-+++ b/arch/powerpc/platforms/85xx/p1022_ds.c
-@@ -208,6 +208,7 @@ static void p1022ds_set_monitor_port(enum fsl_diu_monitor_port port)
- 	u8 __iomem *lbc_lcs0_ba = NULL;
- 	u8 __iomem *lbc_lcs1_ba = NULL;
- 	phys_addr_t cs0_addr, cs1_addr;
-+	u32 br0, or0, br1, or1;
- 	const __be32 *iprop;
- 	unsigned int num_laws;
- 	u8 b;
-@@ -256,11 +257,70 @@ static void p1022ds_set_monitor_port(enum fsl_diu_monitor_port port)
- 	}
- 	num_laws = be32_to_cpup(iprop);
- 
--	cs0_addr = lbc_br_to_phys(ecm, num_laws, in_be32(&lbc->bank[0].br));
--	cs1_addr = lbc_br_to_phys(ecm, num_laws, in_be32(&lbc->bank[1].br));
-+	/*
-+	 * Indirect mode requires both BR0 and BR1 to be set to "GPCM",
-+	 * otherwise writes to these addresses won't actually appear on the
-+	 * local bus, and so the PIXIS won't see them.
-+	 *
-+	 * In FCM mode, writes go to the NAND controller, which does not pass
-+	 * them to the localbus directly.  So we force BR0 and BR1 into GPCM
-+	 * mode, since we don't care about what's behind the localbus any
-+	 * more.
-+	 */
-+	br0 = in_be32(&lbc->bank[0].br);
-+	br1 = in_be32(&lbc->bank[1].br);
-+	or0 = in_be32(&lbc->bank[0].or);
-+	or1 = in_be32(&lbc->bank[1].or);
-+
-+	/* Make sure CS0 and CS1 are programmed */
-+	if (!(br0 & BR_V) || !(br1 & BR_V)) {
-+		pr_err("p1022ds: CS0 and/or CS1 is not programmed\n");
-+		goto exit;
-+	}
-+
-+	/*
-+	 * Use the existing BRx/ORx values if it's already GPCM. Otherwise,
-+	 * force the values to simple 32KB GPCM windows with the most
-+	 * conservative timing.
-+	 */
-+	if ((br0 & BR_MSEL) != BR_MS_GPCM) {
-+		br0 = (br0 & BR_BA) | BR_V;
-+		or0 = 0xFFFF8000 | 0xFF7;
-+		out_be32(&lbc->bank[0].br, br0);
-+		out_be32(&lbc->bank[0].or, or0);
-+	}
-+	if ((br1 & BR_MSEL) != BR_MS_GPCM) {
-+		br1 = (br1 & BR_BA) | BR_V;
-+		or1 = 0xFFFF8000 | 0xFF7;
-+		out_be32(&lbc->bank[1].br, br1);
-+		out_be32(&lbc->bank[1].or, or1);
-+	}
-+
-+	cs0_addr = lbc_br_to_phys(ecm, num_laws, br0);
-+	if (!cs0_addr) {
-+		pr_err("p1022ds: could not determine physical address for CS0"
-+		       " (BR0=%08x)\n", br0);
-+		goto exit;
-+	}
-+	cs1_addr = lbc_br_to_phys(ecm, num_laws, br1);
-+	if (!cs0_addr) {
-+		pr_err("p1022ds: could not determine physical address for CS1"
-+		       " (BR1=%08x)\n", br1);
-+		goto exit;
-+	}
- 
- 	lbc_lcs0_ba = ioremap(cs0_addr, 1);
-+	if (!lbc_lcs0_ba) {
-+		pr_err("p1022ds: could not ioremap CS0 address %llx\n",
-+		       (unsigned long long)cs0_addr);
-+		goto exit;
-+	}
- 	lbc_lcs1_ba = ioremap(cs1_addr, 1);
-+	if (!lbc_lcs1_ba) {
-+		pr_err("p1022ds: could not ioremap CS1 address %llx\n",
-+		       (unsigned long long)cs1_addr);
-+		goto exit;
-+	}
- 
- 	/* Make sure we're in indirect mode first. */
- 	if ((in_be32(&guts->pmuxcr) & PMUXCR_ELBCDIU_MASK) !=
-@@ -435,6 +495,8 @@ static void __init disable_one_node(struct device_node *np, struct property *new
- 		prom_update_property(np, new, old);
- 	else
- 		prom_add_property(np, new);
-+
-+	pr_info("p1022ds: disabling %s node\n", np->full_name);
- }
- 
- /* TRUE if there is a "video=fslfb" command-line parameter. */
-@@ -499,28 +561,46 @@ static void __init p1022_ds_setup_arch(void)
- 	diu_ops.valid_monitor_port	= p1022ds_valid_monitor_port;
- 
- 	/*
--	 * Disable the NOR flash node if there is video=fslfb... command-line
--	 * parameter.  When the DIU is active, NOR flash is unavailable, so we
--	 * have to disable the node before the MTD driver loads.
-+	 * Disable the NOR and NAND flash nodes if there is video=fslfb...
-+	 * command-line parameter.  When the DIU is active, the localbus is
-+	 * unavailable, so we have to disable these nodes before the MTD
-+	 * driver loads.
- 	 */
- 	if (fslfb) {
- 		struct device_node *np =
- 			of_find_compatible_node(NULL, NULL, "fsl,p1022-elbc");
- 
- 		if (np) {
--			np = of_find_compatible_node(np, NULL, "cfi-flash");
--			if (np) {
-+			struct device_node *np2;
-+
-+			of_node_get(np);
-+			np2 = of_find_compatible_node(np, NULL, "cfi-flash");
-+			if (np2) {
- 				static struct property nor_status = {
- 					.name = "status",
- 					.value = "disabled",
- 					.length = sizeof("disabled"),
- 				};
- 
--				pr_info("p1022ds: disabling %s node",
--					np->full_name);
--				disable_one_node(np, &nor_status);
--				of_node_put(np);
-+				disable_one_node(np2, &nor_status);
-+				of_node_put(np2);
-+			}
-+
-+			of_node_get(np);
-+			np2 = of_find_compatible_node(np, NULL,
-+						      "fsl,elbc-fcm-nand");
-+			if (np2) {
-+				static struct property nand_status = {
-+					.name = "status",
-+					.value = "disabled",
-+					.length = sizeof("disabled"),
-+				};
-+
-+				disable_one_node(np2, &nand_status);
-+				of_node_put(np2);
- 			}
-+
-+			of_node_put(np);
- 		}
- 
- 	}
-diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
-index 2297be4..abe8722 100644
---- a/arch/s390/oprofile/init.c
-+++ b/arch/s390/oprofile/init.c
-@@ -171,7 +171,7 @@ static ssize_t hw_interval_write(struct file *file, char const __user *buf,
- 	if (*offset)
- 		return -EINVAL;
- 	retval = oprofilefs_ulong_from_user(&val, buf, count);
--	if (retval)
-+	if (retval <= 0)
- 		return retval;
- 	if (val < oprofile_min_interval)
- 		oprofile_hw_interval = oprofile_min_interval;
-@@ -214,7 +214,7 @@ static ssize_t hwsampler_zero_write(struct file *file, char const __user *buf,
- 		return -EINVAL;
- 
- 	retval = oprofilefs_ulong_from_user(&val, buf, count);
--	if (retval)
-+	if (retval <= 0)
- 		return retval;
- 	if (val != 0)
- 		return -EINVAL;
-@@ -245,7 +245,7 @@ static ssize_t hwsampler_kernel_write(struct file *file, char const __user *buf,
- 		return -EINVAL;
- 
- 	retval = oprofilefs_ulong_from_user(&val, buf, count);
--	if (retval)
-+	if (retval <= 0)
- 		return retval;
- 
- 	if (val != 0 && val != 1)
-@@ -280,7 +280,7 @@ static ssize_t hwsampler_user_write(struct file *file, char const __user *buf,
- 		return -EINVAL;
- 
- 	retval = oprofilefs_ulong_from_user(&val, buf, count);
--	if (retval)
-+	if (retval <= 0)
- 		return retval;
- 
- 	if (val != 0 && val != 1)
-@@ -319,7 +319,7 @@ static ssize_t timer_enabled_write(struct file *file, char const __user *buf,
- 		return -EINVAL;
- 
- 	retval = oprofilefs_ulong_from_user(&val, buf, count);
--	if (retval)
-+	if (retval <= 0)
- 		return retval;
- 
- 	if (val != 0 && val != 1)
-diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
-index 93971e8..472b9b7 100644
---- a/arch/x86/include/asm/xen/page.h
-+++ b/arch/x86/include/asm/xen/page.h
-@@ -51,7 +51,8 @@ extern unsigned long set_phys_range_identity(unsigned long pfn_s,
- 
- extern int m2p_add_override(unsigned long mfn, struct page *page,
- 			    struct gnttab_map_grant_ref *kmap_op);
--extern int m2p_remove_override(struct page *page, bool clear_pte);
-+extern int m2p_remove_override(struct page *page,
-+				struct gnttab_map_grant_ref *kmap_op);
- extern struct page *m2p_find_override(unsigned long mfn);
- extern unsigned long m2p_find_override_pfn(unsigned long mfn, unsigned long pfn);
- 
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 6b9333b..cc9c146 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -144,6 +144,8 @@ static int __init x86_xsave_setup(char *s)
- {
- 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
- 	setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
-+	setup_clear_cpu_cap(X86_FEATURE_AVX);
-+	setup_clear_cpu_cap(X86_FEATURE_AVX2);
- 	return 1;
- }
- __setup("noxsave", x86_xsave_setup);
-diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
-index da9bcdc..4018f6e 100644
---- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
-+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
-@@ -207,6 +207,15 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
- 	return -EOPNOTSUPP;
- }
- 
-+static const struct perf_event_attr ibs_notsupp = {
-+	.exclude_user	= 1,
-+	.exclude_kernel	= 1,
-+	.exclude_hv	= 1,
-+	.exclude_idle	= 1,
-+	.exclude_host	= 1,
-+	.exclude_guest	= 1,
-+};
-+
- static int perf_ibs_init(struct perf_event *event)
- {
- 	struct hw_perf_event *hwc = &event->hw;
-@@ -227,6 +236,9 @@ static int perf_ibs_init(struct perf_event *event)
- 	if (event->pmu != &perf_ibs->pmu)
- 		return -ENOENT;
- 
-+	if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp))
-+		return -EINVAL;
-+
- 	if (config & ~perf_ibs->config_mask)
- 		return -EINVAL;
- 
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index ff962d4..405307f 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -1422,6 +1422,10 @@ asmlinkage void __init xen_start_kernel(void)
- 		pci_request_acs();
- 
- 		xen_acpi_sleep_register();
-+
-+		/* Avoid searching for BIOS MP tables */
-+		x86_init.mpparse.find_smp_config = x86_init_noop;
-+		x86_init.mpparse.get_smp_config = x86_init_uint_noop;
- 	}
- #ifdef CONFIG_PCI
- 	/* PCI BIOS service won't work from a PV guest. */
-diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
-index 76ba0e9..72213da 100644
---- a/arch/x86/xen/p2m.c
-+++ b/arch/x86/xen/p2m.c
-@@ -828,9 +828,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
- 
- 			xen_mc_issue(PARAVIRT_LAZY_MMU);
- 		}
--		/* let's use dev_bus_addr to record the old mfn instead */
--		kmap_op->dev_bus_addr = page->index;
--		page->index = (unsigned long) kmap_op;
- 	}
- 	spin_lock_irqsave(&m2p_override_lock, flags);
- 	list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
-@@ -857,7 +854,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(m2p_add_override);
--int m2p_remove_override(struct page *page, bool clear_pte)
-+int m2p_remove_override(struct page *page,
-+		struct gnttab_map_grant_ref *kmap_op)
- {
- 	unsigned long flags;
- 	unsigned long mfn;
-@@ -887,10 +885,8 @@ int m2p_remove_override(struct page *page, bool clear_pte)
- 	WARN_ON(!PagePrivate(page));
- 	ClearPagePrivate(page);
- 
--	if (clear_pte) {
--		struct gnttab_map_grant_ref *map_op =
--			(struct gnttab_map_grant_ref *) page->index;
--		set_phys_to_machine(pfn, map_op->dev_bus_addr);
-+	set_phys_to_machine(pfn, page->index);
-+	if (kmap_op != NULL) {
- 		if (!PageHighMem(page)) {
- 			struct multicall_space mcs;
- 			struct gnttab_unmap_grant_ref *unmap_op;
-@@ -902,13 +898,13 @@ int m2p_remove_override(struct page *page, bool clear_pte)
- 			 * issued. In this case handle is going to -1 because
- 			 * it hasn't been modified yet.
- 			 */
--			if (map_op->handle == -1)
-+			if (kmap_op->handle == -1)
- 				xen_mc_flush();
- 			/*
--			 * Now if map_op->handle is negative it means that the
-+			 * Now if kmap_op->handle is negative it means that the
- 			 * hypercall actually returned an error.
- 			 */
--			if (map_op->handle == GNTST_general_error) {
-+			if (kmap_op->handle == GNTST_general_error) {
- 				printk(KERN_WARNING "m2p_remove_override: "
- 						"pfn %lx mfn %lx, failed to modify kernel mappings",
- 						pfn, mfn);
-@@ -918,8 +914,8 @@ int m2p_remove_override(struct page *page, bool clear_pte)
- 			mcs = xen_mc_entry(
- 					sizeof(struct gnttab_unmap_grant_ref));
- 			unmap_op = mcs.args;
--			unmap_op->host_addr = map_op->host_addr;
--			unmap_op->handle = map_op->handle;
-+			unmap_op->host_addr = kmap_op->host_addr;
-+			unmap_op->handle = kmap_op->handle;
- 			unmap_op->dev_bus_addr = 0;
- 
- 			MULTI_grant_table_op(mcs.mc,
-@@ -930,10 +926,9 @@ int m2p_remove_override(struct page *page, bool clear_pte)
- 			set_pte_at(&init_mm, address, ptep,
- 					pfn_pte(pfn, PAGE_KERNEL));
- 			__flush_tlb_single(address);
--			map_op->host_addr = 0;
-+			kmap_op->host_addr = 0;
- 		}
--	} else
--		set_phys_to_machine(pfn, page->index);
-+	}
- 
- 	/* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
- 	 * somewhere in this domain, even before being added to the
-diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
-index f2583ed..c207fdb 100644
---- a/arch/x86/xen/setup.c
-+++ b/arch/x86/xen/setup.c
-@@ -17,6 +17,7 @@
- #include <asm/e820.h>
- #include <asm/setup.h>
- #include <asm/acpi.h>
-+#include <asm/numa.h>
- #include <asm/xen/hypervisor.h>
- #include <asm/xen/hypercall.h>
- 
-@@ -549,4 +550,7 @@ void __init xen_arch_setup(void)
- 	disable_cpufreq();
- 	WARN_ON(set_pm_idle_to_default());
- 	fiddle_vdso();
-+#ifdef CONFIG_NUMA
-+	numa_off = 1;
-+#endif
- }
-diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
-index adceafd..92107ee 100644
---- a/drivers/acpi/bus.c
-+++ b/drivers/acpi/bus.c
-@@ -237,6 +237,16 @@ static int __acpi_bus_get_power(struct acpi_device *device, int *state)
- 	} else if (result == ACPI_STATE_D3_HOT) {
- 		result = ACPI_STATE_D3;
- 	}
-+
-+	/*
-+	 * If we were unsure about the device parent's power state up to this
-+	 * point, the fact that the device is in D0 implies that the parent has
-+	 * to be in D0 too.
-+	 */
-+	if (device->parent && device->parent->power.state == ACPI_STATE_UNKNOWN
-+	    && result == ACPI_STATE_D0)
-+		device->parent->power.state = ACPI_STATE_D0;
-+
- 	*state = result;
- 
-  out:
-diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
-index dd6d6a3..fe71911 100644
---- a/drivers/acpi/power.c
-+++ b/drivers/acpi/power.c
-@@ -103,6 +103,7 @@ struct acpi_power_resource {
- 
- 	/* List of devices relying on this power resource */
- 	struct acpi_power_resource_device *devices;
-+	struct mutex devices_lock;
- };
- 
- static struct list_head acpi_power_resource_list;
-@@ -221,7 +222,6 @@ static void acpi_power_on_device(struct acpi_power_managed_device *device)
- 
- static int __acpi_power_on(struct acpi_power_resource *resource)
- {
--	struct acpi_power_resource_device *device_list = resource->devices;
- 	acpi_status status = AE_OK;
- 
- 	status = acpi_evaluate_object(resource->device->handle, "_ON", NULL, NULL);
-@@ -234,19 +234,15 @@ static int __acpi_power_on(struct acpi_power_resource *resource)
- 	ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Power resource [%s] turned on\n",
- 			  resource->name));
- 
--	while (device_list) {
--		acpi_power_on_device(device_list->device);
--
--		device_list = device_list->next;
--	}
--
- 	return 0;
- }
- 
- static int acpi_power_on(acpi_handle handle)
- {
- 	int result = 0;
-+	bool resume_device = false;
- 	struct acpi_power_resource *resource = NULL;
-+	struct acpi_power_resource_device *device_list;
- 
- 	result = acpi_power_get_context(handle, &resource);
- 	if (result)
-@@ -262,10 +258,25 @@ static int acpi_power_on(acpi_handle handle)
- 		result = __acpi_power_on(resource);
- 		if (result)
- 			resource->ref_count--;
-+		else
-+			resume_device = true;
- 	}
- 
- 	mutex_unlock(&resource->resource_lock);
- 
-+	if (!resume_device)
-+		return result;
-+
-+	mutex_lock(&resource->devices_lock);
-+
-+	device_list = resource->devices;
-+	while (device_list) {
-+		acpi_power_on_device(device_list->device);
-+		device_list = device_list->next;
-+	}
-+
-+	mutex_unlock(&resource->devices_lock);
-+
- 	return result;
- }
- 
-@@ -351,7 +362,7 @@ static void __acpi_power_resource_unregister_device(struct device *dev,
- 	if (acpi_power_get_context(res_handle, &resource))
- 		return;
- 
--	mutex_lock(&resource->resource_lock);
-+	mutex_lock(&resource->devices_lock);
- 	prev = NULL;
- 	curr = resource->devices;
- 	while (curr) {
-@@ -368,7 +379,7 @@ static void __acpi_power_resource_unregister_device(struct device *dev,
- 		prev = curr;
- 		curr = curr->next;
- 	}
--	mutex_unlock(&resource->resource_lock);
-+	mutex_unlock(&resource->devices_lock);
- }
- 
- /* Unlink dev from all power resources in _PR0 */
-@@ -409,10 +420,10 @@ static int __acpi_power_resource_register_device(
- 
- 	power_resource_device->device = powered_device;
- 
--	mutex_lock(&resource->resource_lock);
-+	mutex_lock(&resource->devices_lock);
- 	power_resource_device->next = resource->devices;
- 	resource->devices = power_resource_device;
--	mutex_unlock(&resource->resource_lock);
-+	mutex_unlock(&resource->devices_lock);
- 
- 	return 0;
- }
-@@ -457,7 +468,7 @@ int acpi_power_resource_register_device(struct device *dev, acpi_handle handle)
- 	return ret;
- 
- no_power_resource:
--	printk(KERN_WARNING PREFIX "Invalid Power Resource to register!");
-+	printk(KERN_DEBUG PREFIX "Invalid Power Resource to register!");
- 	return -ENODEV;
- }
- 
-@@ -715,6 +726,7 @@ static int acpi_power_add(struct acpi_device *device)
- 
- 	resource->device = device;
- 	mutex_init(&resource->resource_lock);
-+	mutex_init(&resource->devices_lock);
- 	strcpy(resource->name, device->pnp.bus_id);
- 	strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
- 	strcpy(acpi_device_class(device), ACPI_POWER_CLASS);
-diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
-index ebaf67e..93cbc44 100644
---- a/drivers/ata/ahci.c
-+++ b/drivers/ata/ahci.c
-@@ -396,6 +396,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
- 	  .driver_data = board_ahci_yes_fbs },			/* 88se9125 */
- 	{ PCI_DEVICE(0x1b4b, 0x917a),
- 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
-+	{ PCI_DEVICE(0x1b4b, 0x9192),
-+	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 on some Gigabyte */
- 	{ PCI_DEVICE(0x1b4b, 0x91a3),
- 	  .driver_data = board_ahci_yes_fbs },
- 
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index cece3a4..71e8385 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4126,6 +4126,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 
- 	/* Devices which aren't very happy with higher link speeds */
- 	{ "WD My Book",			NULL,	ATA_HORKAGE_1_5_GBPS, },
-+	{ "Seagate FreeAgent GoFlex",	NULL,	ATA_HORKAGE_1_5_GBPS, },
- 
- 	/*
- 	 * Devices which choke on SETXFER.  Applies only if both the
-diff --git a/drivers/base/core.c b/drivers/base/core.c
-index b18138a..c598122 100644
---- a/drivers/base/core.c
-+++ b/drivers/base/core.c
-@@ -1895,8 +1895,8 @@ int __dev_printk(const char *level, const struct device *dev,
- 				    "DEVICE=+%s:%s", subsys, dev_name(dev));
- 	}
- skip:
--	if (level[3])
--		level_extra = &level[3]; /* skip past "<L>" */
-+	if (level[2])
-+		level_extra = &level[2]; /* skip past KERN_SOH "L" */
- 
- 	return printk_emit(0, level[1] - '0',
- 			   dictlen ? dict : NULL, dictlen,
-diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
-index 5989487..7d9c1cb 100644
---- a/drivers/base/power/runtime.c
-+++ b/drivers/base/power/runtime.c
-@@ -147,6 +147,8 @@ static int rpm_check_suspend_allowed(struct device *dev)
- 	    || (dev->power.request_pending
- 			&& dev->power.request == RPM_REQ_RESUME))
- 		retval = -EAGAIN;
-+	else if (__dev_pm_qos_read_value(dev) < 0)
-+		retval = -EPERM;
- 	else if (dev->power.runtime_status == RPM_SUSPENDED)
- 		retval = 1;
- 
-@@ -388,7 +390,6 @@ static int rpm_suspend(struct device *dev, int rpmflags)
- 		goto repeat;
- 	}
- 
--	dev->power.deferred_resume = false;
- 	if (dev->power.no_callbacks)
- 		goto no_callback;	/* Assume success. */
- 
-@@ -403,12 +404,6 @@ static int rpm_suspend(struct device *dev, int rpmflags)
- 		goto out;
- 	}
- 
--	if (__dev_pm_qos_read_value(dev) < 0) {
--		/* Negative PM QoS constraint means "never suspend". */
--		retval = -EPERM;
--		goto out;
--	}
--
- 	__update_runtime_status(dev, RPM_SUSPENDING);
- 
- 	if (dev->pm_domain)
-@@ -440,6 +435,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
- 	wake_up_all(&dev->power.wait_queue);
- 
- 	if (dev->power.deferred_resume) {
-+		dev->power.deferred_resume = false;
- 		rpm_resume(dev, 0);
- 		retval = -EAGAIN;
- 		goto out;
-@@ -584,6 +580,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
- 		    || dev->parent->power.runtime_status == RPM_ACTIVE) {
- 			atomic_inc(&dev->parent->power.child_count);
- 			spin_unlock(&dev->parent->power.lock);
-+			retval = 1;
- 			goto no_callback;	/* Assume success. */
- 		}
- 		spin_unlock(&dev->parent->power.lock);
-@@ -664,7 +661,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
- 	}
- 	wake_up_all(&dev->power.wait_queue);
- 
--	if (!retval)
-+	if (retval >= 0)
- 		rpm_idle(dev, RPM_ASYNC);
- 
-  out:
-diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
-index 38aa6dd..da33111 100644
---- a/drivers/block/cciss_scsi.c
-+++ b/drivers/block/cciss_scsi.c
-@@ -795,6 +795,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,
- 				}
- 			break;
- 			case CMD_PROTOCOL_ERR:
-+				cmd->result = DID_ERROR << 16;
- 				dev_warn(&h->pdev->dev,
- 					"%p has protocol error\n", c);
-                         break;
-diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
-index 061427a..3c4c225 100644
---- a/drivers/block/nbd.c
-+++ b/drivers/block/nbd.c
-@@ -445,6 +445,14 @@ static void nbd_clear_que(struct nbd_device *nbd)
- 		req->errors++;
- 		nbd_end_request(req);
- 	}
-+
-+	while (!list_empty(&nbd->waiting_queue)) {
-+		req = list_entry(nbd->waiting_queue.next, struct request,
-+				 queuelist);
-+		list_del_init(&req->queuelist);
-+		req->errors++;
-+		nbd_end_request(req);
-+	}
- }
- 
- 
-@@ -594,6 +602,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
- 		nbd->file = NULL;
- 		nbd_clear_que(nbd);
- 		BUG_ON(!list_empty(&nbd->queue_head));
-+		BUG_ON(!list_empty(&nbd->waiting_queue));
- 		if (file)
- 			fput(file);
- 		return 0;
-diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
-index 73f196c..c6decb9 100644
---- a/drivers/block/xen-blkback/blkback.c
-+++ b/drivers/block/xen-blkback/blkback.c
-@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pending_req *req)
- 		invcount++;
- 	}
- 
--	ret = gnttab_unmap_refs(unmap, pages, invcount, false);
-+	ret = gnttab_unmap_refs(unmap, NULL, pages, invcount);
- 	BUG_ON(ret);
- }
- 
-diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
-index 10308cd..fc2de55 100644
---- a/drivers/bluetooth/ath3k.c
-+++ b/drivers/bluetooth/ath3k.c
-@@ -79,12 +79,14 @@ static struct usb_device_id ath3k_table[] = {
- 	{ USB_DEVICE(0x13d3, 0x3362) },
- 	{ USB_DEVICE(0x0CF3, 0xE004) },
- 	{ USB_DEVICE(0x0930, 0x0219) },
-+	{ USB_DEVICE(0x0489, 0xe057) },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xE02C) },
- 
- 	/* Atheros AR5BBU22 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xE03C) },
-+	{ USB_DEVICE(0x0489, 0xE036) },
- 
- 	{ }	/* Terminating entry */
- };
-@@ -104,9 +106,11 @@ static struct usb_device_id ath3k_blist_tbl[] = {
- 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
- 
- 	/* Atheros AR5BBU22 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
- 
- 	{ }	/* Terminating entry */
- };
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 83ebb24..b5f008c 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -60,6 +60,9 @@ static struct usb_device_id btusb_table[] = {
- 	/* Generic Bluetooth USB device */
- 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
- 
-+	/* Apple-specific (Broadcom) devices */
-+	{ USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
-+
- 	/* Broadcom SoftSailing reporting vendor specific */
- 	{ USB_DEVICE(0x0a5c, 0x21e1) },
- 
-@@ -102,15 +105,14 @@ static struct usb_device_id btusb_table[] = {
- 
- 	/* Broadcom BCM20702A0 */
- 	{ USB_DEVICE(0x0489, 0xe042) },
--	{ USB_DEVICE(0x0a5c, 0x21e3) },
--	{ USB_DEVICE(0x0a5c, 0x21e6) },
--	{ USB_DEVICE(0x0a5c, 0x21e8) },
--	{ USB_DEVICE(0x0a5c, 0x21f3) },
- 	{ USB_DEVICE(0x413c, 0x8197) },
- 
- 	/* Foxconn - Hon Hai */
- 	{ USB_DEVICE(0x0489, 0xe033) },
- 
-+	/*Broadcom devices with vendor specific id */
-+	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
-+
- 	{ }	/* Terminating entry */
- };
- 
-@@ -141,12 +143,14 @@ static struct usb_device_id blacklist_table[] = {
- 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
- 
- 	/* Broadcom BCM2035 */
- 	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
-diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
-index c0e8164..1a40935 100644
---- a/drivers/cpufreq/powernow-k8.c
-+++ b/drivers/cpufreq/powernow-k8.c
-@@ -35,7 +35,6 @@
- #include <linux/slab.h>
- #include <linux/string.h>
- #include <linux/cpumask.h>
--#include <linux/sched.h>	/* for current / set_cpus_allowed() */
- #include <linux/io.h>
- #include <linux/delay.h>
- 
-@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(struct powernow_k8_data *data,
- 	return res;
- }
- 
--/* Driver entry point to switch to the target frequency */
--static int powernowk8_target(struct cpufreq_policy *pol,
--		unsigned targfreq, unsigned relation)
-+struct powernowk8_target_arg {
-+	struct cpufreq_policy		*pol;
-+	unsigned			targfreq;
-+	unsigned			relation;
-+};
-+
-+static long powernowk8_target_fn(void *arg)
- {
--	cpumask_var_t oldmask;
-+	struct powernowk8_target_arg *pta = arg;
-+	struct cpufreq_policy *pol = pta->pol;
-+	unsigned targfreq = pta->targfreq;
-+	unsigned relation = pta->relation;
- 	struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
- 	u32 checkfid;
- 	u32 checkvid;
- 	unsigned int newstate;
--	int ret = -EIO;
-+	int ret;
- 
- 	if (!data)
- 		return -EINVAL;
-@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpufreq_policy *pol,
- 	checkfid = data->currfid;
- 	checkvid = data->currvid;
- 
--	/* only run on specific CPU from here on. */
--	/* This is poor form: use a workqueue or smp_call_function_single */
--	if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
--		return -ENOMEM;
--
--	cpumask_copy(oldmask, tsk_cpus_allowed(current));
--	set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
--
--	if (smp_processor_id() != pol->cpu) {
--		printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
--		goto err_out;
--	}
--
- 	if (pending_bit_stuck()) {
- 		printk(KERN_ERR PFX "failing targ, change pending bit set\n");
--		goto err_out;
-+		return -EIO;
- 	}
- 
- 	pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
- 		pol->cpu, targfreq, pol->min, pol->max, relation);
- 
- 	if (query_current_values_with_pending_wait(data))
--		goto err_out;
-+		return -EIO;
- 
- 	if (cpu_family != CPU_HW_PSTATE) {
- 		pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
-@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
- 
- 	if (cpufreq_frequency_table_target(pol, data->powernow_table,
- 				targfreq, relation, &newstate))
--		goto err_out;
-+		return -EIO;
- 
- 	mutex_lock(&fidvid_mutex);
- 
-@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpufreq_policy *pol,
- 		ret = transition_frequency_fidvid(data, newstate);
- 	if (ret) {
- 		printk(KERN_ERR PFX "transition frequency failed\n");
--		ret = 1;
- 		mutex_unlock(&fidvid_mutex);
--		goto err_out;
-+		return 1;
- 	}
- 	mutex_unlock(&fidvid_mutex);
- 
-@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpufreq_policy *pol,
- 				data->powernow_table[newstate].index);
- 	else
- 		pol->cur = find_khz_freq_from_fid(data->currfid);
--	ret = 0;
- 
--err_out:
--	set_cpus_allowed_ptr(current, oldmask);
--	free_cpumask_var(oldmask);
--	return ret;
-+	return 0;
-+}
-+
-+/* Driver entry point to switch to the target frequency */
-+static int powernowk8_target(struct cpufreq_policy *pol,
-+		unsigned targfreq, unsigned relation)
-+{
-+	struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
-+					     .relation = relation };
-+
-+	/*
-+	 * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
-+	 * that we're bound to the current CPU and pol->cpu stays online.
-+	 */
-+	if (smp_processor_id() == pol->cpu)
-+		return powernowk8_target_fn(&pta);
-+	else
-+		return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
- }
- 
- /* Driver entry point to verify the policy and range of frequencies */
-diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
-index 7292aa8..4058430 100644
---- a/drivers/dma/at_hdmac.c
-+++ b/drivers/dma/at_hdmac.c
-@@ -662,7 +662,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
- 			flags);
- 
- 	if (unlikely(!atslave || !sg_len)) {
--		dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
-+		dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
- 		return NULL;
- 	}
- 
-@@ -690,6 +690,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
- 
- 			mem = sg_dma_address(sg);
- 			len = sg_dma_len(sg);
-+			if (unlikely(!len)) {
-+				dev_dbg(chan2dev(chan),
-+					"prep_slave_sg: sg(%d) data length is zero\n", i);
-+				goto err;
-+			}
- 			mem_width = 2;
- 			if (unlikely(mem & 3 || len & 3))
- 				mem_width = 0;
-@@ -725,6 +730,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
- 
- 			mem = sg_dma_address(sg);
- 			len = sg_dma_len(sg);
-+			if (unlikely(!len)) {
-+				dev_dbg(chan2dev(chan),
-+					"prep_slave_sg: sg(%d) data length is zero\n", i);
-+				goto err;
-+			}
- 			mem_width = 2;
- 			if (unlikely(mem & 3 || len & 3))
- 				mem_width = 0;
-@@ -758,6 +768,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
- 
- err_desc_get:
- 	dev_err(chan2dev(chan), "not enough descriptors available\n");
-+err:
- 	atc_desc_put(atchan, first);
- 	return NULL;
- }
-diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
-index e4feba6..f5843bc 100644
---- a/drivers/dma/pl330.c
-+++ b/drivers/dma/pl330.c
-@@ -1567,17 +1567,19 @@ static int pl330_submit_req(void *ch_id, struct pl330_req *r)
- 		goto xfer_exit;
- 	}
- 
--	/* Prefer Secure Channel */
--	if (!_manager_ns(thrd))
--		r->cfg->nonsecure = 0;
--	else
--		r->cfg->nonsecure = 1;
- 
- 	/* Use last settings, if not provided */
--	if (r->cfg)
-+	if (r->cfg) {
-+		/* Prefer Secure Channel */
-+		if (!_manager_ns(thrd))
-+			r->cfg->nonsecure = 0;
-+		else
-+			r->cfg->nonsecure = 1;
-+
- 		ccr = _prepare_ccr(r->cfg);
--	else
-+	} else {
- 		ccr = readl(regs + CC(thrd->id));
-+	}
- 
- 	/* If this req doesn't have valid xfer settings */
- 	if (!_is_valid(ccr)) {
-@@ -2928,6 +2930,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
- 		num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
- 
- 	pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
-+	if (!pdmac->peripherals) {
-+		ret = -ENOMEM;
-+		dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
-+		goto probe_err5;
-+	}
- 
- 	for (i = 0; i < num_chan; i++) {
- 		pch = &pdmac->peripherals[i];
-diff --git a/drivers/gpio/gpio-lpc32xx.c b/drivers/gpio/gpio-lpc32xx.c
-index c2199be..6cee3a6 100644
---- a/drivers/gpio/gpio-lpc32xx.c
-+++ b/drivers/gpio/gpio-lpc32xx.c
-@@ -307,6 +307,7 @@ static int lpc32xx_gpio_dir_output_p012(struct gpio_chip *chip, unsigned pin,
- {
- 	struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
- 
-+	__set_gpio_level_p012(group, pin, value);
- 	__set_gpio_dir_p012(group, pin, 0);
- 
- 	return 0;
-@@ -317,6 +318,7 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
- {
- 	struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
- 
-+	__set_gpio_level_p3(group, pin, value);
- 	__set_gpio_dir_p3(group, pin, 0);
- 
- 	return 0;
-@@ -325,6 +327,9 @@ static int lpc32xx_gpio_dir_output_p3(struct gpio_chip *chip, unsigned pin,
- static int lpc32xx_gpio_dir_out_always(struct gpio_chip *chip, unsigned pin,
- 	int value)
- {
-+	struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
-+
-+	__set_gpo_level_p3(group, pin, value);
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 08a7aa7..6fbfc24 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -1981,7 +1981,7 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
- 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
- 		return -EINVAL;
- 
--	if (!req->flags)
-+	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
- 		return -EINVAL;
- 
- 	mutex_lock(&dev->mode_config.mutex);
-diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
-index a8743c3..b7ee230 100644
---- a/drivers/gpu/drm/drm_edid.c
-+++ b/drivers/gpu/drm/drm_edid.c
-@@ -87,6 +87,9 @@ static struct edid_quirk {
- 	int product_id;
- 	u32 quirks;
- } edid_quirk_list[] = {
-+	/* ASUS VW222S */
-+	{ "ACI", 0x22a2, EDID_QUIRK_FORCE_REDUCED_BLANKING },
-+
- 	/* Acer AL1706 */
- 	{ "ACR", 44358, EDID_QUIRK_PREFER_LARGE_60 },
- 	/* Acer F51 */
-diff --git a/drivers/gpu/drm/gma500/oaktrail_device.c b/drivers/gpu/drm/gma500/oaktrail_device.c
-index 0f9b7db..cf49ba5 100644
---- a/drivers/gpu/drm/gma500/oaktrail_device.c
-+++ b/drivers/gpu/drm/gma500/oaktrail_device.c
-@@ -476,6 +476,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
- 		.pos = DSPAPOS,
- 		.surf = DSPASURF,
- 		.addr = MRST_DSPABASE,
-+		.base = MRST_DSPABASE,
- 		.status = PIPEASTAT,
- 		.linoff = DSPALINOFF,
- 		.tileoff = DSPATILEOFF,
-@@ -499,6 +500,7 @@ static const struct psb_offset oaktrail_regmap[2] = {
- 		.pos = DSPBPOS,
- 		.surf = DSPBSURF,
- 		.addr = DSPBBASE,
-+		.base = DSPBBASE,
- 		.status = PIPEBSTAT,
- 		.linoff = DSPBLINOFF,
- 		.tileoff = DSPBTILEOFF,
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 288d7b8..35926ad 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -3044,7 +3044,8 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
- {
- 	int ret;
- 
--	BUG_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
-+	if (WARN_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
-+		return -EBUSY;
- 
- 	if (obj->gtt_space != NULL) {
- 		if ((alignment && obj->gtt_offset & (alignment - 1)) ||
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index ed3224c..acc91b1 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -2626,9 +2626,6 @@ void intel_irq_init(struct drm_device *dev)
- 			dev->driver->irq_handler = i8xx_irq_handler;
- 			dev->driver->irq_uninstall = i8xx_irq_uninstall;
- 		} else if (INTEL_INFO(dev)->gen == 3) {
--			/* IIR "flip pending" means done if this bit is set */
--			I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
--
- 			dev->driver->irq_preinstall = i915_irq_preinstall;
- 			dev->driver->irq_postinstall = i915_irq_postinstall;
- 			dev->driver->irq_uninstall = i915_irq_uninstall;
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index 75a70c4..1f0741f 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -284,6 +284,36 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
- 	return ret;
- }
- 
-+static struct edid *intel_crt_get_edid(struct drm_connector *connector,
-+				struct i2c_adapter *i2c)
-+{
-+	struct edid *edid;
-+
-+	edid = drm_get_edid(connector, i2c);
-+
-+	if (!edid && !intel_gmbus_is_forced_bit(i2c)) {
-+		DRM_DEBUG_KMS("CRT GMBUS EDID read failed, retry using GPIO bit-banging\n");
-+		intel_gmbus_force_bit(i2c, true);
-+		edid = drm_get_edid(connector, i2c);
-+		intel_gmbus_force_bit(i2c, false);
-+	}
-+
-+	return edid;
-+}
-+
-+/* local version of intel_ddc_get_modes() to use intel_crt_get_edid() */
-+static int intel_crt_ddc_get_modes(struct drm_connector *connector,
-+				struct i2c_adapter *adapter)
-+{
-+	struct edid *edid;
-+
-+	edid = intel_crt_get_edid(connector, adapter);
-+	if (!edid)
-+		return 0;
-+
-+	return intel_connector_update_modes(connector, edid);
-+}
-+
- static bool intel_crt_detect_ddc(struct drm_connector *connector)
- {
- 	struct intel_crt *crt = intel_attached_crt(connector);
-@@ -299,7 +329,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
- 		struct i2c_adapter *i2c;
- 
- 		i2c = intel_gmbus_get_adapter(dev_priv, dev_priv->crt_ddc_pin);
--		edid = drm_get_edid(connector, i2c);
-+		edid = intel_crt_get_edid(connector, i2c);
- 		/*
- 		 * This may be a DVI-I connector with a shared DDC
- 		 * link between analog and digital outputs, so we
-@@ -498,13 +528,13 @@ static int intel_crt_get_modes(struct drm_connector *connector)
- 	struct i2c_adapter *i2c;
- 
- 	i2c = intel_gmbus_get_adapter(dev_priv, dev_priv->crt_ddc_pin);
--	ret = intel_ddc_get_modes(connector, i2c);
-+	ret = intel_crt_ddc_get_modes(connector, i2c);
- 	if (ret || !IS_G4X(dev))
- 		return ret;
- 
- 	/* Try to probe digital port for output in DVI-I -> VGA mode. */
- 	i2c = intel_gmbus_get_adapter(dev_priv, GMBUS_PORT_DPB);
--	return intel_ddc_get_modes(connector, i2c);
-+	return intel_crt_ddc_get_modes(connector, i2c);
- }
- 
- static int intel_crt_set_property(struct drm_connector *connector,
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 8a11131..2f22bea 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -1238,7 +1238,7 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
- 				     enum pipe pipe, int reg)
- {
- 	u32 val = I915_READ(reg);
--	WARN(hdmi_pipe_enabled(dev_priv, val, pipe),
-+	WARN(hdmi_pipe_enabled(dev_priv, pipe, val),
- 	     "PCH HDMI (0x%08x) enabled on transcoder %c, should be disabled\n",
- 	     reg, pipe_name(pipe));
- }
-@@ -1255,13 +1255,13 @@ static void assert_pch_ports_disabled(struct drm_i915_private *dev_priv,
- 
- 	reg = PCH_ADPA;
- 	val = I915_READ(reg);
--	WARN(adpa_pipe_enabled(dev_priv, val, pipe),
-+	WARN(adpa_pipe_enabled(dev_priv, pipe, val),
- 	     "PCH VGA enabled on transcoder %c, should be disabled\n",
- 	     pipe_name(pipe));
- 
- 	reg = PCH_LVDS;
- 	val = I915_READ(reg);
--	WARN(lvds_pipe_enabled(dev_priv, val, pipe),
-+	WARN(lvds_pipe_enabled(dev_priv, pipe, val),
- 	     "PCH LVDS enabled on transcoder %c, should be disabled\n",
- 	     pipe_name(pipe));
- 
-@@ -1723,7 +1723,7 @@ static void disable_pch_hdmi(struct drm_i915_private *dev_priv,
- 			     enum pipe pipe, int reg)
- {
- 	u32 val = I915_READ(reg);
--	if (hdmi_pipe_enabled(dev_priv, val, pipe)) {
-+	if (hdmi_pipe_enabled(dev_priv, pipe, val)) {
- 		DRM_DEBUG_KMS("Disabling pch HDMI %x on pipe %d\n",
- 			      reg, pipe);
- 		I915_WRITE(reg, val & ~PORT_ENABLE);
-@@ -1745,12 +1745,12 @@ static void intel_disable_pch_ports(struct drm_i915_private *dev_priv,
- 
- 	reg = PCH_ADPA;
- 	val = I915_READ(reg);
--	if (adpa_pipe_enabled(dev_priv, val, pipe))
-+	if (adpa_pipe_enabled(dev_priv, pipe, val))
- 		I915_WRITE(reg, val & ~ADPA_DAC_ENABLE);
- 
- 	reg = PCH_LVDS;
- 	val = I915_READ(reg);
--	if (lvds_pipe_enabled(dev_priv, val, pipe)) {
-+	if (lvds_pipe_enabled(dev_priv, pipe, val)) {
- 		DRM_DEBUG_KMS("disable lvds on pipe %d val 0x%08x\n", pipe, val);
- 		I915_WRITE(reg, val & ~LVDS_PORT_EN);
- 		POSTING_READ(reg);
-@@ -3926,12 +3926,6 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
- 	POSTING_READ(DPLL(pipe));
- 	udelay(150);
- 
--	I915_WRITE(DPLL(pipe), dpll);
--
--	/* Wait for the clocks to stabilize. */
--	POSTING_READ(DPLL(pipe));
--	udelay(150);
--
- 	/* The LVDS pin pair needs to be on before the DPLLs are enabled.
- 	 * This is an exception to the general rule that mode_set doesn't turn
- 	 * things on.
-@@ -3939,6 +3933,12 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
- 	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
- 		intel_update_lvds(crtc, clock, adjusted_mode);
- 
-+	I915_WRITE(DPLL(pipe), dpll);
-+
-+	/* Wait for the clocks to stabilize. */
-+	POSTING_READ(DPLL(pipe));
-+	udelay(150);
-+
- 	/* The pixel multiplier can only be updated once the
- 	 * DPLL is enabled and the clocks are stable.
- 	 *
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index 3e09188..9040191 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -334,6 +334,8 @@ struct intel_fbc_work {
- 	int interval;
- };
- 
-+int intel_connector_update_modes(struct drm_connector *connector,
-+				struct edid *edid);
- int intel_ddc_get_modes(struct drm_connector *c, struct i2c_adapter *adapter);
- extern bool intel_ddc_probe(struct intel_encoder *intel_encoder, int ddc_bus);
- 
-diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
-index 2ead3bf..bc1f0f2 100644
---- a/drivers/gpu/drm/i915/intel_hdmi.c
-+++ b/drivers/gpu/drm/i915/intel_hdmi.c
-@@ -400,7 +400,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
- 	u32 temp;
- 	u32 enable_bits = SDVO_ENABLE;
- 
--	if (intel_hdmi->has_audio)
-+	if (intel_hdmi->has_audio || mode != DRM_MODE_DPMS_ON)
- 		enable_bits |= SDVO_AUDIO_ENABLE;
- 
- 	temp = I915_READ(intel_hdmi->sdvox_reg);
-diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
-index d67ec3a..e019146 100644
---- a/drivers/gpu/drm/i915/intel_modes.c
-+++ b/drivers/gpu/drm/i915/intel_modes.c
-@@ -61,6 +61,25 @@ bool intel_ddc_probe(struct intel_encoder *intel_encoder, int ddc_bus)
- }
- 
- /**
-+ * intel_connector_update_modes - update connector from edid
-+ * @connector: DRM connector device to use
-+ * @edid: previously read EDID information
-+ */
-+int intel_connector_update_modes(struct drm_connector *connector,
-+				struct edid *edid)
-+{
-+	int ret;
-+
-+	drm_mode_connector_update_edid_property(connector, edid);
-+	ret = drm_add_edid_modes(connector, edid);
-+	drm_edid_to_eld(connector, edid);
-+	connector->display_info.raw_edid = NULL;
-+	kfree(edid);
-+
-+	return ret;
-+}
-+
-+/**
-  * intel_ddc_get_modes - get modelist from monitor
-  * @connector: DRM connector device to use
-  * @adapter: i2c adapter
-@@ -71,18 +90,12 @@ int intel_ddc_get_modes(struct drm_connector *connector,
- 			struct i2c_adapter *adapter)
- {
- 	struct edid *edid;
--	int ret = 0;
- 
- 	edid = drm_get_edid(connector, adapter);
--	if (edid) {
--		drm_mode_connector_update_edid_property(connector, edid);
--		ret = drm_add_edid_modes(connector, edid);
--		drm_edid_to_eld(connector, edid);
--		connector->display_info.raw_edid = NULL;
--		kfree(edid);
--	}
-+	if (!edid)
-+		return 0;
- 
--	return ret;
-+	return intel_connector_update_modes(connector, edid);
- }
- 
- static const struct drm_prop_enum_list force_audio_names[] = {
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index d0ce2a5..a48c391 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -2431,10 +2431,10 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
- 	I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
- 		   dev_priv->max_delay << 24 |
- 		   dev_priv->min_delay << 16);
--	I915_WRITE(GEN6_RP_UP_THRESHOLD, 10000);
--	I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 1000000);
--	I915_WRITE(GEN6_RP_UP_EI, 100000);
--	I915_WRITE(GEN6_RP_DOWN_EI, 5000000);
-+	I915_WRITE(GEN6_RP_UP_THRESHOLD, 59400);
-+	I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 245000);
-+	I915_WRITE(GEN6_RP_UP_EI, 66000);
-+	I915_WRITE(GEN6_RP_DOWN_EI, 350000);
- 	I915_WRITE(GEN6_RP_IDLE_HYSTERSIS, 10);
- 	I915_WRITE(GEN6_RP_CONTROL,
- 		   GEN6_RP_MEDIA_TURBO |
-@@ -3528,6 +3528,9 @@ static void gen3_init_clock_gating(struct drm_device *dev)
- 
- 	if (IS_PINEVIEW(dev))
- 		I915_WRITE(ECOSKPD, _MASKED_BIT_ENABLE(ECO_GATING_CX_ONLY));
-+
-+	/* IIR "flip pending" means done if this bit is set */
-+	I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
- }
- 
- static void i85x_init_clock_gating(struct drm_device *dev)
-diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
-index b6a9d45..74d47a3 100644
---- a/drivers/gpu/drm/i915/intel_sdvo.c
-+++ b/drivers/gpu/drm/i915/intel_sdvo.c
-@@ -2552,25 +2552,12 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
- 		}
- 	}
- 
--	if (intel_sdvo->is_sdvob)
--		dev_priv->hotplug_supported_mask |= SDVOB_HOTPLUG_INT_STATUS;
--	else
--		dev_priv->hotplug_supported_mask |= SDVOC_HOTPLUG_INT_STATUS;
--
- 	drm_encoder_helper_add(&intel_encoder->base, &intel_sdvo_helper_funcs);
- 
- 	/* In default case sdvo lvds is false */
- 	if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
- 		goto err;
- 
--	/* Set up hotplug command - note paranoia about contents of reply.
--	 * We assume that the hardware is in a sane state, and only touch
--	 * the bits we think we understand.
--	 */
--	intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
--			     &intel_sdvo->hotplug_active, 2);
--	intel_sdvo->hotplug_active[0] &= ~0x3;
--
- 	if (intel_sdvo_output_setup(intel_sdvo,
- 				    intel_sdvo->caps.output_flags) != true) {
- 		DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
-@@ -2578,6 +2565,16 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
- 		goto err;
- 	}
- 
-+	/* Only enable the hotplug irq if we need it, to work around noisy
-+	 * hotplug lines.
-+	 */
-+	if (intel_sdvo->hotplug_active[0]) {
-+		if (intel_sdvo->is_sdvob)
-+			dev_priv->hotplug_supported_mask |= SDVOB_HOTPLUG_INT_STATUS;
-+		else
-+			dev_priv->hotplug_supported_mask |= SDVOC_HOTPLUG_INT_STATUS;
-+	}
-+
- 	intel_sdvo_select_ddc_bus(dev_priv, intel_sdvo, sdvo_reg);
- 
- 	/* Set the input timing to the screen. Assume always input 0. */
-diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
-index 69688ef..7e16dc5 100644
---- a/drivers/gpu/drm/nouveau/nouveau_display.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
-@@ -598,7 +598,7 @@ nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
- 	args->size = args->pitch * args->height;
- 	args->size = roundup(args->size, PAGE_SIZE);
- 
--	ret = nouveau_gem_new(dev, args->size, 0, TTM_PL_FLAG_VRAM, 0, 0, &bo);
-+	ret = nouveau_gem_new(dev, args->size, 0, NOUVEAU_GEM_DOMAIN_VRAM, 0, 0, &bo);
- 	if (ret)
- 		return ret;
- 
-diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
-index 19706f0..22a90a0 100644
---- a/drivers/gpu/drm/nouveau/nouveau_state.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
-@@ -737,9 +737,11 @@ nouveau_card_init(struct drm_device *dev)
- 			}
- 			break;
- 		case NV_C0:
--			nvc0_copy_create(dev, 1);
-+			if (!(nv_rd32(dev, 0x022500) & 0x00000200))
-+				nvc0_copy_create(dev, 1);
- 		case NV_D0:
--			nvc0_copy_create(dev, 0);
-+			if (!(nv_rd32(dev, 0x022500) & 0x00000100))
-+				nvc0_copy_create(dev, 0);
- 			break;
- 		default:
- 			break;
-diff --git a/drivers/gpu/drm/nouveau/nv84_fifo.c b/drivers/gpu/drm/nouveau/nv84_fifo.c
-index cc82d79..c564c5e 100644
---- a/drivers/gpu/drm/nouveau/nv84_fifo.c
-+++ b/drivers/gpu/drm/nouveau/nv84_fifo.c
-@@ -117,17 +117,22 @@ nv84_fifo_context_del(struct nouveau_channel *chan, int engine)
- 	struct drm_device *dev = chan->dev;
- 	struct drm_nouveau_private *dev_priv = dev->dev_private;
- 	unsigned long flags;
-+	u32 save;
- 
- 	/* remove channel from playlist, will context switch if active */
- 	spin_lock_irqsave(&dev_priv->context_switch_lock, flags);
- 	nv_mask(dev, 0x002600 + (chan->id * 4), 0x80000000, 0x00000000);
- 	nv50_fifo_playlist_update(dev);
- 
-+	save = nv_mask(dev, 0x002520, 0x0000003f, 0x15);
-+
- 	/* tell any engines on this channel to unload their contexts */
- 	nv_wr32(dev, 0x0032fc, chan->ramin->vinst >> 12);
- 	if (!nv_wait_ne(dev, 0x0032fc, 0xffffffff, 0xffffffff))
- 		NV_INFO(dev, "PFIFO: channel %d unload timeout\n", chan->id);
- 
-+	nv_wr32(dev, 0x002520, save);
-+
- 	nv_wr32(dev, 0x002600 + (chan->id * 4), 0x00000000);
- 	spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
- 
-@@ -184,10 +189,13 @@ nv84_fifo_fini(struct drm_device *dev, int engine, bool suspend)
- 	struct drm_nouveau_private *dev_priv = dev->dev_private;
- 	struct nv84_fifo_priv *priv = nv_engine(dev, engine);
- 	int i;
-+	u32 save;
- 
- 	/* set playlist length to zero, fifo will unload context */
- 	nv_wr32(dev, 0x0032ec, 0);
- 
-+	save = nv_mask(dev, 0x002520, 0x0000003f, 0x15);
-+
- 	/* tell all connected engines to unload their contexts */
- 	for (i = 0; i < priv->base.channels; i++) {
- 		struct nouveau_channel *chan = dev_priv->channels.ptr[i];
-@@ -199,6 +207,7 @@ nv84_fifo_fini(struct drm_device *dev, int engine, bool suspend)
- 		}
- 	}
- 
-+	nv_wr32(dev, 0x002520, save);
- 	nv_wr32(dev, 0x002140, 0);
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index 7915944..25b8014 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -258,7 +258,6 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
- 		radeon_crtc->enabled = true;
- 		/* adjust pm to dpms changes BEFORE enabling crtcs */
- 		radeon_pm_compute_clocks(rdev);
--		/* disable crtc pair power gating before programming */
- 		if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set)
- 			atombios_powergate_crtc(crtc, ATOM_DISABLE);
- 		atombios_enable_crtc(crtc, ATOM_ENABLE);
-@@ -278,25 +277,8 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
- 			atombios_enable_crtc_memreq(crtc, ATOM_DISABLE);
- 		atombios_enable_crtc(crtc, ATOM_DISABLE);
- 		radeon_crtc->enabled = false;
--		/* power gating is per-pair */
--		if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set) {
--			struct drm_crtc *other_crtc;
--			struct radeon_crtc *other_radeon_crtc;
--			list_for_each_entry(other_crtc, &rdev->ddev->mode_config.crtc_list, head) {
--				other_radeon_crtc = to_radeon_crtc(other_crtc);
--				if (((radeon_crtc->crtc_id == 0) && (other_radeon_crtc->crtc_id == 1)) ||
--				    ((radeon_crtc->crtc_id == 1) && (other_radeon_crtc->crtc_id == 0)) ||
--				    ((radeon_crtc->crtc_id == 2) && (other_radeon_crtc->crtc_id == 3)) ||
--				    ((radeon_crtc->crtc_id == 3) && (other_radeon_crtc->crtc_id == 2)) ||
--				    ((radeon_crtc->crtc_id == 4) && (other_radeon_crtc->crtc_id == 5)) ||
--				    ((radeon_crtc->crtc_id == 5) && (other_radeon_crtc->crtc_id == 4))) {
--					/* if both crtcs in the pair are off, enable power gating */
--					if (other_radeon_crtc->enabled == false)
--						atombios_powergate_crtc(crtc, ATOM_ENABLE);
--					break;
--				}
--			}
--		}
-+		if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set)
-+			atombios_powergate_crtc(crtc, ATOM_ENABLE);
- 		/* adjust pm to dpms changes AFTER disabling crtcs */
- 		radeon_pm_compute_clocks(rdev);
- 		break;
-@@ -444,11 +426,28 @@ union atom_enable_ss {
- static void atombios_crtc_program_ss(struct radeon_device *rdev,
- 				     int enable,
- 				     int pll_id,
-+				     int crtc_id,
- 				     struct radeon_atom_ss *ss)
- {
-+	unsigned i;
- 	int index = GetIndexIntoMasterTable(COMMAND, EnableSpreadSpectrumOnPPLL);
- 	union atom_enable_ss args;
- 
-+	if (!enable) {
-+		for (i = 0; i < rdev->num_crtc; i++) {
-+			if (rdev->mode_info.crtcs[i] &&
-+			    rdev->mode_info.crtcs[i]->enabled &&
-+			    i != crtc_id &&
-+			    pll_id == rdev->mode_info.crtcs[i]->pll_id) {
-+				/* one other crtc is using this pll don't turn
-+				 * off spread spectrum as it might turn off
-+				 * display on active crtc
-+				 */
-+				return;
-+			}
-+		}
-+	}
-+
- 	memset(&args, 0, sizeof(args));
- 
- 	if (ASIC_IS_DCE5(rdev)) {
-@@ -1036,7 +1035,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
- 		radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
- 					  &ref_div, &post_div);
- 
--	atombios_crtc_program_ss(rdev, ATOM_DISABLE, radeon_crtc->pll_id, &ss);
-+	atombios_crtc_program_ss(rdev, ATOM_DISABLE, radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss);
- 
- 	atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
- 				  encoder_mode, radeon_encoder->encoder_id, mode->clock,
-@@ -1059,7 +1058,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
- 			ss.step = step_size;
- 		}
- 
--		atombios_crtc_program_ss(rdev, ATOM_ENABLE, radeon_crtc->pll_id, &ss);
-+		atombios_crtc_program_ss(rdev, ATOM_ENABLE, radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss);
- 	}
- }
- 
-@@ -1576,11 +1575,11 @@ void radeon_atom_disp_eng_pll_init(struct radeon_device *rdev)
- 								   ASIC_INTERNAL_SS_ON_DCPLL,
- 								   rdev->clock.default_dispclk);
- 		if (ss_enabled)
--			atombios_crtc_program_ss(rdev, ATOM_DISABLE, ATOM_DCPLL, &ss);
-+			atombios_crtc_program_ss(rdev, ATOM_DISABLE, ATOM_DCPLL, -1, &ss);
- 		/* XXX: DCE5, make sure voltage, dispclk is high enough */
- 		atombios_crtc_set_disp_eng_pll(rdev, rdev->clock.default_dispclk);
- 		if (ss_enabled)
--			atombios_crtc_program_ss(rdev, ATOM_ENABLE, ATOM_DCPLL, &ss);
-+			atombios_crtc_program_ss(rdev, ATOM_ENABLE, ATOM_DCPLL, -1, &ss);
- 	}
- 
- }
-@@ -1669,9 +1668,22 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
- 	struct drm_device *dev = crtc->dev;
- 	struct radeon_device *rdev = dev->dev_private;
- 	struct radeon_atom_ss ss;
-+	int i;
- 
- 	atombios_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
- 
-+	for (i = 0; i < rdev->num_crtc; i++) {
-+		if (rdev->mode_info.crtcs[i] &&
-+		    rdev->mode_info.crtcs[i]->enabled &&
-+		    i != radeon_crtc->crtc_id &&
-+		    radeon_crtc->pll_id == rdev->mode_info.crtcs[i]->pll_id) {
-+			/* one other crtc is using this pll don't turn
-+			 * off the pll
-+			 */
-+			goto done;
-+		}
-+	}
-+
- 	switch (radeon_crtc->pll_id) {
- 	case ATOM_PPLL1:
- 	case ATOM_PPLL2:
-@@ -1688,6 +1700,7 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
- 	default:
- 		break;
- 	}
-+done:
- 	radeon_crtc->pll_id = -1;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
-index 8676b1b..700dfab 100644
---- a/drivers/gpu/drm/radeon/atombios_encoders.c
-+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
-@@ -1379,6 +1379,8 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
- 	struct drm_device *dev = encoder->dev;
- 	struct radeon_device *rdev = dev->dev_private;
- 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-+	struct drm_encoder *ext_encoder = radeon_get_external_encoder(encoder);
-+	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
- 	struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
- 	struct radeon_connector *radeon_connector = NULL;
- 	struct radeon_connector_atom_dig *radeon_dig_connector = NULL;
-@@ -1390,19 +1392,37 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
- 
- 	switch (mode) {
- 	case DRM_MODE_DPMS_ON:
--		/* some early dce3.2 boards have a bug in their transmitter control table */
--		if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730) ||
--		    ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
--			if (ASIC_IS_DCE6(rdev)) {
--				/* It seems we need to call ATOM_ENCODER_CMD_SETUP again
--				 * before reenabling encoder on DPMS ON, otherwise we never
--				 * get picture
--				 */
--				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-+		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
-+			if (!connector)
-+				dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
-+			else
-+				dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
-+
-+			/* setup and enable the encoder */
-+			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-+			atombios_dig_encoder_setup(encoder,
-+						   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
-+						   dig->panel_mode);
-+			if (ext_encoder) {
-+				if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
-+					atombios_external_encoder_setup(encoder, ext_encoder,
-+									EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
- 			}
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
--		} else {
-+		} else if (ASIC_IS_DCE4(rdev)) {
-+			/* setup and enable the encoder */
-+			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-+			/* enable the transmitter */
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
-+		} else {
-+			/* setup and enable the encoder and transmitter */
-+			atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-+			/* some early dce3.2 boards have a bug in their transmitter control table */
-+			if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730))
-+				atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
- 		}
- 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
- 			if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
-@@ -1420,10 +1440,19 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
- 	case DRM_MODE_DPMS_STANDBY:
- 	case DRM_MODE_DPMS_SUSPEND:
- 	case DRM_MODE_DPMS_OFF:
--		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
-+		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
-+			/* disable the transmitter */
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
--		else
-+		} else if (ASIC_IS_DCE4(rdev)) {
-+			/* disable the transmitter */
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-+		} else {
-+			/* disable the encoder and transmitter */
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-+			atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
-+		}
- 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
- 			if (ASIC_IS_DCE4(rdev))
- 				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
-@@ -1740,13 +1769,34 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
- 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
- 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
- 	struct drm_encoder *test_encoder;
--	struct radeon_encoder_atom_dig *dig;
-+	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
- 	uint32_t dig_enc_in_use = 0;
- 
--	/* DCE4/5 */
--	if (ASIC_IS_DCE4(rdev)) {
--		dig = radeon_encoder->enc_priv;
--		if (ASIC_IS_DCE41(rdev)) {
-+	if (ASIC_IS_DCE6(rdev)) {
-+		/* DCE6 */
-+		switch (radeon_encoder->encoder_id) {
-+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
-+			if (dig->linkb)
-+				return 1;
-+			else
-+				return 0;
-+			break;
-+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
-+			if (dig->linkb)
-+				return 3;
-+			else
-+				return 2;
-+			break;
-+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
-+			if (dig->linkb)
-+				return 5;
-+			else
-+				return 4;
-+			break;
-+		}
-+	} else if (ASIC_IS_DCE4(rdev)) {
-+		/* DCE4/5 */
-+		if (ASIC_IS_DCE41(rdev) && !ASIC_IS_DCE61(rdev)) {
- 			/* ontario follows DCE4 */
- 			if (rdev->family == CHIP_PALM) {
- 				if (dig->linkb)
-@@ -1848,10 +1898,12 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
- 	struct drm_device *dev = encoder->dev;
- 	struct radeon_device *rdev = dev->dev_private;
- 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
--	struct drm_encoder *ext_encoder = radeon_get_external_encoder(encoder);
- 
- 	radeon_encoder->pixel_clock = adjusted_mode->clock;
- 
-+	/* need to call this here rather than in prepare() since we need some crtc info */
-+	radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
-+
- 	if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE4(rdev)) {
- 		if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
- 			atombios_yuv_setup(encoder, true);
-@@ -1870,38 +1922,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
- 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
- 	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
--		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
--			struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
--			struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
--
--			if (!connector)
--				dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
--			else
--				dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
--
--			/* setup and enable the encoder */
--			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
--			atombios_dig_encoder_setup(encoder,
--						   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
--						   dig->panel_mode);
--		} else if (ASIC_IS_DCE4(rdev)) {
--			/* disable the transmitter */
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
--			/* setup and enable the encoder */
--			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
--
--			/* enable the transmitter */
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
--		} else {
--			/* disable the encoder and transmitter */
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
--			atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
--
--			/* setup and enable the encoder and transmitter */
--			atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
--		}
-+		/* handled in dpms */
- 		break;
- 	case ENCODER_OBJECT_ID_INTERNAL_DDI:
- 	case ENCODER_OBJECT_ID_INTERNAL_DVO1:
-@@ -1922,14 +1943,6 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
- 		break;
- 	}
- 
--	if (ext_encoder) {
--		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
--			atombios_external_encoder_setup(encoder, ext_encoder,
--							EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
--		else
--			atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE);
--	}
--
- 	atombios_apply_encoder_quirks(encoder, adjusted_mode);
- 
- 	if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_HDMI) {
-@@ -2116,7 +2129,6 @@ static void radeon_atom_encoder_prepare(struct drm_encoder *encoder)
- 	}
- 
- 	radeon_atom_output_lock(encoder, true);
--	radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
- 
- 	if (connector) {
- 		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
-@@ -2137,6 +2149,7 @@ static void radeon_atom_encoder_prepare(struct drm_encoder *encoder)
- 
- static void radeon_atom_encoder_commit(struct drm_encoder *encoder)
- {
-+	/* need to call this here as we need the crtc set up */
- 	radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_ON);
- 	radeon_atom_output_lock(encoder, false);
- }
-@@ -2177,14 +2190,7 @@ static void radeon_atom_encoder_disable(struct drm_encoder *encoder)
- 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
- 	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
--		if (ASIC_IS_DCE4(rdev))
--			/* disable the transmitter */
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
--		else {
--			/* disable the encoder and transmitter */
--			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
--			atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
--		}
-+		/* handled in dpms */
- 		break;
- 	case ENCODER_OBJECT_ID_INTERNAL_DDI:
- 	case ENCODER_OBJECT_ID_INTERNAL_DVO1:
-diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
-index fefcca5..5c8a0bf 100644
---- a/drivers/gpu/drm/radeon/radeon.h
-+++ b/drivers/gpu/drm/radeon/radeon.h
-@@ -143,21 +143,6 @@ struct radeon_device;
- /*
-  * BIOS.
-  */
--#define ATRM_BIOS_PAGE 4096
--
--#if defined(CONFIG_VGA_SWITCHEROO)
--bool radeon_atrm_supported(struct pci_dev *pdev);
--int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len);
--#else
--static inline bool radeon_atrm_supported(struct pci_dev *pdev)
--{
--	return false;
--}
--
--static inline int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len){
--	return -EINVAL;
--}
--#endif
- bool radeon_get_bios(struct radeon_device *rdev);
- 
- 
-@@ -323,6 +308,7 @@ struct radeon_bo_va {
- 	uint64_t			soffset;
- 	uint64_t			eoffset;
- 	uint32_t			flags;
-+	struct radeon_fence		*fence;
- 	bool				valid;
- };
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index b1e3820..5e30e12 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -452,7 +452,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
- 	}
- 
- 	/* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */
--	if ((dev->pdev->device == 0x9802) &&
-+	if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) &&
- 	    (dev->pdev->subsystem_vendor == 0x1734) &&
- 	    (dev->pdev->subsystem_device == 0x11bd)) {
- 		if (*connector_type == DRM_MODE_CONNECTOR_VGA) {
-diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-index 98724fc..2a2cf0b 100644
---- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-@@ -30,57 +30,8 @@ static struct radeon_atpx_priv {
- 	/* handle for device - and atpx */
- 	acpi_handle dhandle;
- 	acpi_handle atpx_handle;
--	acpi_handle atrm_handle;
- } radeon_atpx_priv;
- 
--/* retrieve the ROM in 4k blocks */
--static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
--			    int offset, int len)
--{
--	acpi_status status;
--	union acpi_object atrm_arg_elements[2], *obj;
--	struct acpi_object_list atrm_arg;
--	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
--
--	atrm_arg.count = 2;
--	atrm_arg.pointer = &atrm_arg_elements[0];
--
--	atrm_arg_elements[0].type = ACPI_TYPE_INTEGER;
--	atrm_arg_elements[0].integer.value = offset;
--
--	atrm_arg_elements[1].type = ACPI_TYPE_INTEGER;
--	atrm_arg_elements[1].integer.value = len;
--
--	status = acpi_evaluate_object(atrm_handle, NULL, &atrm_arg, &buffer);
--	if (ACPI_FAILURE(status)) {
--		printk("failed to evaluate ATRM got %s\n", acpi_format_exception(status));
--		return -ENODEV;
--	}
--
--	obj = (union acpi_object *)buffer.pointer;
--	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
--	len = obj->buffer.length;
--	kfree(buffer.pointer);
--	return len;
--}
--
--bool radeon_atrm_supported(struct pci_dev *pdev)
--{
--	/* get the discrete ROM only via ATRM */
--	if (!radeon_atpx_priv.atpx_detected)
--		return false;
--
--	if (radeon_atpx_priv.dhandle == DEVICE_ACPI_HANDLE(&pdev->dev))
--		return false;
--	return true;
--}
--
--
--int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len)
--{
--	return radeon_atrm_call(radeon_atpx_priv.atrm_handle, bios, offset, len);
--}
--
- static int radeon_atpx_get_version(acpi_handle handle)
- {
- 	acpi_status status;
-@@ -198,7 +149,7 @@ static int radeon_atpx_power_state(enum vga_switcheroo_client_id id,
- 
- static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
- {
--	acpi_handle dhandle, atpx_handle, atrm_handle;
-+	acpi_handle dhandle, atpx_handle;
- 	acpi_status status;
- 
- 	dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
-@@ -209,13 +160,8 @@ static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
- 	if (ACPI_FAILURE(status))
- 		return false;
- 
--	status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
--	if (ACPI_FAILURE(status))
--		return false;
--
- 	radeon_atpx_priv.dhandle = dhandle;
- 	radeon_atpx_priv.atpx_handle = atpx_handle;
--	radeon_atpx_priv.atrm_handle = atrm_handle;
- 	return true;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
-index 501f488..d306cc8 100644
---- a/drivers/gpu/drm/radeon/radeon_bios.c
-+++ b/drivers/gpu/drm/radeon/radeon_bios.c
-@@ -32,6 +32,7 @@
- 
- #include <linux/vga_switcheroo.h>
- #include <linux/slab.h>
-+#include <linux/acpi.h>
- /*
-  * BIOS.
-  */
-@@ -98,16 +99,81 @@ static bool radeon_read_bios(struct radeon_device *rdev)
- 	return true;
- }
- 
-+#ifdef CONFIG_ACPI
- /* ATRM is used to get the BIOS on the discrete cards in
-  * dual-gpu systems.
-  */
-+/* retrieve the ROM in 4k blocks */
-+#define ATRM_BIOS_PAGE 4096
-+/**
-+ * radeon_atrm_call - fetch a chunk of the vbios
-+ *
-+ * @atrm_handle: acpi ATRM handle
-+ * @bios: vbios image pointer
-+ * @offset: offset of vbios image data to fetch
-+ * @len: length of vbios image data to fetch
-+ *
-+ * Executes ATRM to fetch a chunk of the discrete
-+ * vbios image on PX systems (all asics).
-+ * Returns the length of the buffer fetched.
-+ */
-+static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
-+			    int offset, int len)
-+{
-+	acpi_status status;
-+	union acpi_object atrm_arg_elements[2], *obj;
-+	struct acpi_object_list atrm_arg;
-+	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
-+
-+	atrm_arg.count = 2;
-+	atrm_arg.pointer = &atrm_arg_elements[0];
-+
-+	atrm_arg_elements[0].type = ACPI_TYPE_INTEGER;
-+	atrm_arg_elements[0].integer.value = offset;
-+
-+	atrm_arg_elements[1].type = ACPI_TYPE_INTEGER;
-+	atrm_arg_elements[1].integer.value = len;
-+
-+	status = acpi_evaluate_object(atrm_handle, NULL, &atrm_arg, &buffer);
-+	if (ACPI_FAILURE(status)) {
-+		printk("failed to evaluate ATRM got %s\n", acpi_format_exception(status));
-+		return -ENODEV;
-+	}
-+
-+	obj = (union acpi_object *)buffer.pointer;
-+	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
-+	len = obj->buffer.length;
-+	kfree(buffer.pointer);
-+	return len;
-+}
-+
- static bool radeon_atrm_get_bios(struct radeon_device *rdev)
- {
- 	int ret;
- 	int size = 256 * 1024;
- 	int i;
-+	struct pci_dev *pdev = NULL;
-+	acpi_handle dhandle, atrm_handle;
-+	acpi_status status;
-+	bool found = false;
-+
-+	/* ATRM is for the discrete card only */
-+	if (rdev->flags & RADEON_IS_IGP)
-+		return false;
-+
-+	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
-+		dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
-+		if (!dhandle)
-+			continue;
-+
-+		status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
-+		if (!ACPI_FAILURE(status)) {
-+			found = true;
-+			break;
-+		}
-+	}
- 
--	if (!radeon_atrm_supported(rdev->pdev))
-+	if (!found)
- 		return false;
- 
- 	rdev->bios = kmalloc(size, GFP_KERNEL);
-@@ -117,9 +183,10 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
- 	}
- 
- 	for (i = 0; i < size / ATRM_BIOS_PAGE; i++) {
--		ret = radeon_atrm_get_bios_chunk(rdev->bios,
--						 (i * ATRM_BIOS_PAGE),
--						 ATRM_BIOS_PAGE);
-+		ret = radeon_atrm_call(atrm_handle,
-+				       rdev->bios,
-+				       (i * ATRM_BIOS_PAGE),
-+				       ATRM_BIOS_PAGE);
- 		if (ret < ATRM_BIOS_PAGE)
- 			break;
- 	}
-@@ -130,6 +197,12 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
- 	}
- 	return true;
- }
-+#else
-+static inline bool radeon_atrm_get_bios(struct radeon_device *rdev)
-+{
-+	return false;
-+}
-+#endif
- 
- static bool ni_read_disabled_bios(struct radeon_device *rdev)
- {
-@@ -476,6 +549,61 @@ static bool radeon_read_disabled_bios(struct radeon_device *rdev)
- 		return legacy_read_disabled_bios(rdev);
- }
- 
-+#ifdef CONFIG_ACPI
-+static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
-+{
-+	bool ret = false;
-+	struct acpi_table_header *hdr;
-+	acpi_size tbl_size;
-+	UEFI_ACPI_VFCT *vfct;
-+	GOP_VBIOS_CONTENT *vbios;
-+	VFCT_IMAGE_HEADER *vhdr;
-+
-+	if (!ACPI_SUCCESS(acpi_get_table_with_size("VFCT", 1, &hdr, &tbl_size)))
-+		return false;
-+	if (tbl_size < sizeof(UEFI_ACPI_VFCT)) {
-+		DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n");
-+		goto out_unmap;
-+	}
-+
-+	vfct = (UEFI_ACPI_VFCT *)hdr;
-+	if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) > tbl_size) {
-+		DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n");
-+		goto out_unmap;
-+	}
-+
-+	vbios = (GOP_VBIOS_CONTENT *)((char *)hdr + vfct->VBIOSImageOffset);
-+	vhdr = &vbios->VbiosHeader;
-+	DRM_INFO("ACPI VFCT contains a BIOS for %02x:%02x.%d %04x:%04x, size %d\n",
-+			vhdr->PCIBus, vhdr->PCIDevice, vhdr->PCIFunction,
-+			vhdr->VendorID, vhdr->DeviceID, vhdr->ImageLength);
-+
-+	if (vhdr->PCIBus != rdev->pdev->bus->number ||
-+	    vhdr->PCIDevice != PCI_SLOT(rdev->pdev->devfn) ||
-+	    vhdr->PCIFunction != PCI_FUNC(rdev->pdev->devfn) ||
-+	    vhdr->VendorID != rdev->pdev->vendor ||
-+	    vhdr->DeviceID != rdev->pdev->device) {
-+		DRM_INFO("ACPI VFCT table is not for this card\n");
-+		goto out_unmap;
-+	};
-+
-+	if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) + vhdr->ImageLength > tbl_size) {
-+		DRM_ERROR("ACPI VFCT image truncated\n");
-+		goto out_unmap;
-+	}
-+
-+	rdev->bios = kmemdup(&vbios->VbiosContent, vhdr->ImageLength, GFP_KERNEL);
-+	ret = !!rdev->bios;
-+
-+out_unmap:
-+	return ret;
-+}
-+#else
-+static inline bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
-+{
-+	return false;
-+}
-+#endif
- 
- bool radeon_get_bios(struct radeon_device *rdev)
- {
-@@ -484,6 +612,8 @@ bool radeon_get_bios(struct radeon_device *rdev)
- 
- 	r = radeon_atrm_get_bios(rdev);
- 	if (r == false)
-+		r = radeon_acpi_vfct_bios(rdev);
-+	if (r == false)
- 		r = igp_read_bios_from_vram(rdev);
- 	if (r == false)
- 		r = radeon_read_bios(rdev);
-diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
-index 17238f4..c84eb1a 100644
---- a/drivers/gpu/drm/radeon/radeon_cs.c
-+++ b/drivers/gpu/drm/radeon/radeon_cs.c
-@@ -294,6 +294,28 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
- 	return 0;
- }
- 
-+static void radeon_bo_vm_fence_va(struct radeon_cs_parser *parser,
-+				  struct radeon_fence *fence)
-+{
-+	struct radeon_fpriv *fpriv = parser->filp->driver_priv;
-+	struct radeon_vm *vm = &fpriv->vm;
-+	struct radeon_bo_list *lobj;
-+
-+	if (parser->chunk_ib_idx == -1)
-+		return;
-+	if ((parser->cs_flags & RADEON_CS_USE_VM) == 0)
-+		return;
-+
-+	list_for_each_entry(lobj, &parser->validated, tv.head) {
-+		struct radeon_bo_va *bo_va;
-+		struct radeon_bo *rbo = lobj->bo;
-+
-+		bo_va = radeon_bo_va(rbo, vm);
-+		radeon_fence_unref(&bo_va->fence);
-+		bo_va->fence = radeon_fence_ref(fence);
-+	}
-+}
-+
- /**
-  * cs_parser_fini() - clean parser states
-  * @parser:	parser structure holding parsing context.
-@@ -306,11 +328,14 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
- {
- 	unsigned i;
- 
--	if (!error)
-+	if (!error) {
-+		/* fence all bo va before ttm_eu_fence_buffer_objects so bo are still reserved */
-+		radeon_bo_vm_fence_va(parser, parser->ib.fence);
- 		ttm_eu_fence_buffer_objects(&parser->validated,
- 					    parser->ib.fence);
--	else
-+	} else {
- 		ttm_eu_backoff_reservation(&parser->validated);
-+	}
- 
- 	if (parser->relocs != NULL) {
- 		for (i = 0; i < parser->nrelocs; i++) {
-@@ -407,7 +432,6 @@ static int radeon_cs_ib_vm_chunk(struct radeon_device *rdev,
- 
- 	if (parser->chunk_ib_idx == -1)
- 		return 0;
--
- 	if ((parser->cs_flags & RADEON_CS_USE_VM) == 0)
- 		return 0;
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index 066c98b..8867400 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -774,7 +774,7 @@ int radeon_device_init(struct radeon_device *rdev,
- 	if (rdev->flags & RADEON_IS_AGP)
- 		rdev->need_dma32 = true;
- 	if ((rdev->flags & RADEON_IS_PCI) &&
--	    (rdev->family < CHIP_RS400))
-+	    (rdev->family <= CHIP_RS740))
- 		rdev->need_dma32 = true;
- 
- 	dma_bits = rdev->need_dma32 ? 32 : 40;
-diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
-index 11f5f40..71298ce 100644
---- a/drivers/gpu/drm/radeon/radeon_fence.c
-+++ b/drivers/gpu/drm/radeon/radeon_fence.c
-@@ -75,7 +75,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
- 
- void radeon_fence_process(struct radeon_device *rdev, int ring)
- {
--	uint64_t seq, last_seq;
-+	uint64_t seq, last_seq, last_emitted;
- 	unsigned count_loop = 0;
- 	bool wake = false;
- 
-@@ -102,13 +102,15 @@ void radeon_fence_process(struct radeon_device *rdev, int ring)
- 	 */
- 	last_seq = atomic64_read(&rdev->fence_drv[ring].last_seq);
- 	do {
-+		last_emitted = rdev->fence_drv[ring].seq;
- 		seq = radeon_fence_read(rdev, ring);
- 		seq |= last_seq & 0xffffffff00000000LL;
- 		if (seq < last_seq) {
--			seq += 0x100000000LL;
-+			seq &= 0xffffffff;
-+			seq |= last_emitted & 0xffffffff00000000LL;
- 		}
- 
--		if (seq == last_seq) {
-+		if (seq <= last_seq || seq > last_emitted) {
- 			break;
- 		}
- 		/* If we loop over we don't want to return without
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index 84b648a..f651f22 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -564,7 +564,7 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
- 		return -EINVAL;
- 	}
- 
--	if (bo_va->valid)
-+	if (bo_va->valid && mem)
- 		return 0;
- 
- 	ngpu_pages = radeon_bo_ngpu_pages(bo);
-@@ -597,11 +597,27 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
- 		     struct radeon_bo *bo)
- {
- 	struct radeon_bo_va *bo_va;
-+	int r;
- 
- 	bo_va = radeon_bo_va(bo, vm);
- 	if (bo_va == NULL)
- 		return 0;
- 
-+	/* wait for va use to end */
-+	while (bo_va->fence) {
-+		r = radeon_fence_wait(bo_va->fence, false);
-+		if (r) {
-+			DRM_ERROR("error while waiting for fence: %d\n", r);
-+		}
-+		if (r == -EDEADLK) {
-+			r = radeon_gpu_reset(rdev);
-+			if (!r)
-+				continue;
-+		}
-+		break;
-+	}
-+	radeon_fence_unref(&bo_va->fence);
-+
- 	radeon_mutex_lock(&rdev->cs_mutex);
- 	mutex_lock(&vm->mutex);
- 	radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
-@@ -661,12 +677,15 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
- 	radeon_vm_unbind_locked(rdev, vm);
- 	radeon_mutex_unlock(&rdev->cs_mutex);
- 
--	/* remove all bo */
-+	/* remove all bo at this point non are busy any more because unbind
-+	 * waited for the last vm fence to signal
-+	 */
- 	r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
- 	if (!r) {
- 		bo_va = radeon_bo_va(rdev->ring_tmp_bo.bo, vm);
- 		list_del_init(&bo_va->bo_list);
- 		list_del_init(&bo_va->vm_list);
-+		radeon_fence_unref(&bo_va->fence);
- 		radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
- 		kfree(bo_va);
- 	}
-@@ -678,6 +697,7 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
- 		r = radeon_bo_reserve(bo_va->bo, false);
- 		if (!r) {
- 			list_del_init(&bo_va->bo_list);
-+			radeon_fence_unref(&bo_va->fence);
- 			radeon_bo_unreserve(bo_va->bo);
- 			kfree(bo_va);
- 		}
-diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
-index 21ec9f5..12207d9 100644
---- a/drivers/gpu/drm/radeon/radeon_gem.c
-+++ b/drivers/gpu/drm/radeon/radeon_gem.c
-@@ -134,25 +134,16 @@ void radeon_gem_object_close(struct drm_gem_object *obj,
- 	struct radeon_device *rdev = rbo->rdev;
- 	struct radeon_fpriv *fpriv = file_priv->driver_priv;
- 	struct radeon_vm *vm = &fpriv->vm;
--	struct radeon_bo_va *bo_va, *tmp;
- 
- 	if (rdev->family < CHIP_CAYMAN) {
- 		return;
- 	}
- 
- 	if (radeon_bo_reserve(rbo, false)) {
-+		dev_err(rdev->dev, "leaking bo va because we fail to reserve bo\n");
- 		return;
- 	}
--	list_for_each_entry_safe(bo_va, tmp, &rbo->va, bo_list) {
--		if (bo_va->vm == vm) {
--			/* remove from this vm address space */
--			mutex_lock(&vm->mutex);
--			list_del(&bo_va->vm_list);
--			mutex_unlock(&vm->mutex);
--			list_del(&bo_va->bo_list);
--			kfree(bo_va);
--		}
--	}
-+	radeon_vm_bo_rmv(rdev, vm, rbo);
- 	radeon_bo_unreserve(rbo);
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
-index 830f1a7..1b2289f 100644
---- a/drivers/gpu/drm/radeon/radeon_object.c
-+++ b/drivers/gpu/drm/radeon/radeon_object.c
-@@ -52,11 +52,7 @@ void radeon_bo_clear_va(struct radeon_bo *bo)
- 
- 	list_for_each_entry_safe(bo_va, tmp, &bo->va, bo_list) {
- 		/* remove from all vm address space */
--		mutex_lock(&bo_va->vm->mutex);
--		list_del(&bo_va->vm_list);
--		mutex_unlock(&bo_va->vm->mutex);
--		list_del(&bo_va->bo_list);
--		kfree(bo_va);
-+		radeon_vm_bo_rmv(bo->rdev, bo_va->vm, bo);
- 	}
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
-index 983658c..7843b36 100644
---- a/drivers/gpu/drm/radeon/radeon_ring.c
-+++ b/drivers/gpu/drm/radeon/radeon_ring.c
-@@ -394,6 +394,7 @@ int radeon_ring_init(struct radeon_device *rdev, struct radeon_ring *ring, unsig
- 	if (radeon_debugfs_ring_init(rdev, ring)) {
- 		DRM_ERROR("Failed to register debugfs file for rings !\n");
- 	}
-+	radeon_ring_lockup_update(ring);
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
-index ba055e9..8d9dc44 100644
---- a/drivers/gpu/drm/udl/udl_connector.c
-+++ b/drivers/gpu/drm/udl/udl_connector.c
-@@ -69,6 +69,13 @@ static int udl_get_modes(struct drm_connector *connector)
- static int udl_mode_valid(struct drm_connector *connector,
- 			  struct drm_display_mode *mode)
- {
-+	struct udl_device *udl = connector->dev->dev_private;
-+	if (!udl->sku_pixel_limit)
-+		return 0;
-+
-+	if (mode->vdisplay * mode->hdisplay > udl->sku_pixel_limit)
-+		return MODE_VIRTUAL_Y;
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index 7279b3e..3a4b15a 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -1159,6 +1159,11 @@ static struct drm_driver driver = {
- 	.open = vmw_driver_open,
- 	.preclose = vmw_preclose,
- 	.postclose = vmw_postclose,
-+
-+	.dumb_create = vmw_dumb_create,
-+	.dumb_map_offset = vmw_dumb_map_offset,
-+	.dumb_destroy = vmw_dumb_destroy,
-+
- 	.fops = &vmwgfx_driver_fops,
- 	.name = VMWGFX_DRIVER_NAME,
- 	.desc = VMWGFX_DRIVER_DESC,
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-index d0f2c07..29c984f 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
-@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private *dev_priv,
- int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
- 				struct drm_file *file_priv);
- 
-+int vmw_dumb_create(struct drm_file *file_priv,
-+		    struct drm_device *dev,
-+		    struct drm_mode_create_dumb *args);
-+
-+int vmw_dumb_map_offset(struct drm_file *file_priv,
-+			struct drm_device *dev, uint32_t handle,
-+			uint64_t *offset);
-+int vmw_dumb_destroy(struct drm_file *file_priv,
-+		     struct drm_device *dev,
-+		     uint32_t handle);
- /**
-  * Overlay control - vmwgfx_overlay.c
-  */
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
-index f2fb8f1..7e07433 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
-@@ -1018,7 +1018,7 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
- 	}
- 
- 
--	event = kzalloc(sizeof(event->event), GFP_KERNEL);
-+	event = kzalloc(sizeof(*event), GFP_KERNEL);
- 	if (unlikely(event == NULL)) {
- 		DRM_ERROR("Failed to allocate an event.\n");
- 		ret = -ENOMEM;
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
-index 22bf9a2..2c6ffe0 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
-@@ -1917,3 +1917,76 @@ err_ref:
- 	vmw_resource_unreference(&res);
- 	return ret;
- }
-+
-+
-+int vmw_dumb_create(struct drm_file *file_priv,
-+		    struct drm_device *dev,
-+		    struct drm_mode_create_dumb *args)
-+{
-+	struct vmw_private *dev_priv = vmw_priv(dev);
-+	struct vmw_master *vmaster = vmw_master(file_priv->master);
-+	struct vmw_user_dma_buffer *vmw_user_bo;
-+	struct ttm_buffer_object *tmp;
-+	int ret;
-+
-+	args->pitch = args->width * ((args->bpp + 7) / 8);
-+	args->size = args->pitch * args->height;
-+
-+	vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
-+	if (vmw_user_bo == NULL)
-+		return -ENOMEM;
-+
-+	ret = ttm_read_lock(&vmaster->lock, true);
-+	if (ret != 0) {
-+		kfree(vmw_user_bo);
-+		return ret;
-+	}
-+
-+	ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
-+			      &vmw_vram_sys_placement, true,
-+			      &vmw_user_dmabuf_destroy);
-+	if (ret != 0)
-+		goto out_no_dmabuf;
-+
-+	tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
-+	ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
-+				   &vmw_user_bo->base,
-+				   false,
-+				   ttm_buffer_type,
-+				   &vmw_user_dmabuf_release, NULL);
-+	if (unlikely(ret != 0))
-+		goto out_no_base_object;
-+
-+	args->handle = vmw_user_bo->base.hash.key;
-+
-+out_no_base_object:
-+	ttm_bo_unref(&tmp);
-+out_no_dmabuf:
-+	ttm_read_unlock(&vmaster->lock);
-+	return ret;
-+}
-+
-+int vmw_dumb_map_offset(struct drm_file *file_priv,
-+			struct drm_device *dev, uint32_t handle,
-+			uint64_t *offset)
-+{
-+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
-+	struct vmw_dma_buffer *out_buf;
-+	int ret;
-+
-+	ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
-+	if (ret != 0)
-+		return -EINVAL;
-+
-+	*offset = out_buf->base.addr_space_offset;
-+	vmw_dmabuf_unreference(&out_buf);
-+	return 0;
-+}
-+
-+int vmw_dumb_destroy(struct drm_file *file_priv,
-+		     struct drm_device *dev,
-+		     uint32_t handle)
-+{
-+	return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
-+					 handle, TTM_REF_USAGE);
-+}
-diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
-index 0f9c146..9500f2f 100644
---- a/drivers/hid/hid-logitech-dj.c
-+++ b/drivers/hid/hid-logitech-dj.c
-@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
- static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
- 					size_t count,
- 					unsigned char report_type);
-+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
- 
- static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
- 						struct dj_report *dj_report)
-@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
- 	if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
- 	    SPFUNCTION_DEVICE_LIST_EMPTY) {
- 		dbg_hid("%s: device list is empty\n", __func__);
-+		djrcv_dev->querying_devices = false;
- 		return;
- 	}
- 
-@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
- 		return;
- 	}
- 
-+	if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
-+		/* The device is already known. No need to reallocate it. */
-+		dbg_hid("%s: device is already known\n", __func__);
-+		return;
-+	}
-+
- 	dj_hiddev = hid_allocate_device();
- 	if (IS_ERR(dj_hiddev)) {
- 		dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
-@@ -306,6 +314,7 @@ static void delayedwork_callback(struct work_struct *work)
- 	struct dj_report dj_report;
- 	unsigned long flags;
- 	int count;
-+	int retval;
- 
- 	dbg_hid("%s\n", __func__);
- 
-@@ -338,6 +347,25 @@ static void delayedwork_callback(struct work_struct *work)
- 		logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
- 		break;
- 	default:
-+	/* A normal report (i. e. not belonging to a pair/unpair notification)
-+	 * arriving here, means that the report arrived but we did not have a
-+	 * paired dj_device associated to the report's device_index, this
-+	 * means that the original "device paired" notification corresponding
-+	 * to this dj_device never arrived to this driver. The reason is that
-+	 * hid-core discards all packets coming from a device while probe() is
-+	 * executing. */
-+	if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
-+		/* ok, we don't know the device, just re-ask the
-+		 * receiver for the list of connected devices. */
-+		retval = logi_dj_recv_query_paired_devices(djrcv_dev);
-+		if (!retval) {
-+			/* everything went fine, so just leave */
-+			break;
-+		}
-+		dev_err(&djrcv_dev->hdev->dev,
-+			"%s:logi_dj_recv_query_paired_devices "
-+			"error:%d\n", __func__, retval);
-+		}
- 		dbg_hid("%s: unexpected report type\n", __func__);
- 	}
- }
-@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
- 	if (!djdev) {
- 		dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
- 			" is NULL, index %d\n", dj_report->device_index);
-+		kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
-+
-+		if (schedule_work(&djrcv_dev->work) == 0) {
-+			dbg_hid("%s: did not schedule the work item, was already "
-+			"queued\n", __func__);
-+		}
- 		return;
- 	}
- 
-@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
- 	if (dj_device == NULL) {
- 		dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
- 			" is NULL, index %d\n", dj_report->device_index);
-+		kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
-+
-+		if (schedule_work(&djrcv_dev->work) == 0) {
-+			dbg_hid("%s: did not schedule the work item, was already "
-+			"queued\n", __func__);
-+		}
- 		return;
- 	}
- 
-@@ -439,7 +479,11 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
- 	struct dj_report *dj_report;
- 	int retval;
- 
--	dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
-+	/* no need to protect djrcv_dev->querying_devices */
-+	if (djrcv_dev->querying_devices)
-+		return 0;
-+
-+	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
- 	if (!dj_report)
- 		return -ENOMEM;
- 	dj_report->report_id = REPORT_ID_DJ_SHORT;
-@@ -450,13 +494,14 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
- 	return retval;
- }
- 
-+
- static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
- 					  unsigned timeout)
- {
- 	struct dj_report *dj_report;
- 	int retval;
- 
--	dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
-+	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
- 	if (!dj_report)
- 		return -ENOMEM;
- 	dj_report->report_id = REPORT_ID_DJ_SHORT;
-diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
-index fd28a5e..4a40003 100644
---- a/drivers/hid/hid-logitech-dj.h
-+++ b/drivers/hid/hid-logitech-dj.h
-@@ -101,6 +101,7 @@ struct dj_receiver_dev {
- 	struct work_struct work;
- 	struct kfifo notif_fifo;
- 	spinlock_t lock;
-+	bool querying_devices;
- };
- 
- struct dj_device {
-diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
-index cfec802..f915eb1 100644
---- a/drivers/hwmon/ad7314.c
-+++ b/drivers/hwmon/ad7314.c
-@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(struct device *dev,
- 	}
- }
- 
-+static ssize_t ad7314_show_name(struct device *dev,
-+				struct device_attribute *devattr, char *buf)
-+{
-+	return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
-+}
-+
-+static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL);
- static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
- 			  ad7314_show_temperature, NULL, 0);
- 
- static struct attribute *ad7314_attributes[] = {
-+	&dev_attr_name.attr,
- 	&sensor_dev_attr_temp1_input.dev_attr.attr,
- 	NULL,
- };
-diff --git a/drivers/hwmon/ads7871.c b/drivers/hwmon/ads7871.c
-index e65c6e4..7bf4ce3 100644
---- a/drivers/hwmon/ads7871.c
-+++ b/drivers/hwmon/ads7871.c
-@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct device *dev,
- 	}
- }
- 
-+static ssize_t ads7871_show_name(struct device *dev,
-+				 struct device_attribute *devattr, char *buf)
-+{
-+	return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
-+}
-+
- static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0);
- static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1);
- static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
-@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_voltage, NULL, 5);
- static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6);
- static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7);
- 
-+static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL);
-+
- static struct attribute *ads7871_attributes[] = {
- 	&sensor_dev_attr_in0_input.dev_attr.attr,
- 	&sensor_dev_attr_in1_input.dev_attr.attr,
-@@ -157,6 +165,7 @@ static struct attribute *ads7871_attributes[] = {
- 	&sensor_dev_attr_in5_input.dev_attr.attr,
- 	&sensor_dev_attr_in6_input.dev_attr.attr,
- 	&sensor_dev_attr_in7_input.dev_attr.attr,
-+	&dev_attr_name.attr,
- 	NULL
- };
- 
-diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
-index 6b13f1a..49dadf4 100644
---- a/drivers/hwmon/fam15h_power.c
-+++ b/drivers/hwmon/fam15h_power.c
-@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
-  * counter saturations resulting in bogus power readings.
-  * We correct this value ourselves to cope with older BIOSes.
-  */
--static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
-+static const struct pci_device_id affected_device[] = {
- 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
- 	{ 0 }
- };
- 
--static void __devinit tweak_runavg_range(struct pci_dev *pdev)
-+static void tweak_runavg_range(struct pci_dev *pdev)
- {
- 	u32 val;
- 
-@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range(struct pci_dev *pdev)
- 		REG_TDP_RUNNING_AVERAGE, val);
- }
- 
-+#ifdef CONFIG_PM
-+static int fam15h_power_resume(struct pci_dev *pdev)
-+{
-+	tweak_runavg_range(pdev);
-+	return 0;
-+}
-+#else
-+#define fam15h_power_resume NULL
-+#endif
-+
- static void __devinit fam15h_power_init_data(struct pci_dev *f4,
- 					     struct fam15h_power_data *data)
- {
-@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_driver = {
- 	.id_table = fam15h_power_id_table,
- 	.probe = fam15h_power_probe,
- 	.remove = __devexit_p(fam15h_power_remove),
-+	.resume = fam15h_power_resume,
- };
- 
- module_pci_driver(fam15h_power_driver);
-diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
-index 7f3f4a3..6021482 100644
---- a/drivers/hwmon/ina2xx.c
-+++ b/drivers/hwmon/ina2xx.c
-@@ -69,22 +69,6 @@ struct ina2xx_data {
- 	u16 regs[INA2XX_MAX_REGISTERS];
- };
- 
--int ina2xx_read_word(struct i2c_client *client, int reg)
--{
--	int val = i2c_smbus_read_word_data(client, reg);
--	if (unlikely(val < 0)) {
--		dev_dbg(&client->dev,
--			"Failed to read register: %d\n", reg);
--		return val;
--	}
--	return be16_to_cpu(val);
--}
--
--void ina2xx_write_word(struct i2c_client *client, int reg, int data)
--{
--	i2c_smbus_write_word_data(client, reg, cpu_to_be16(data));
--}
--
- static struct ina2xx_data *ina2xx_update_device(struct device *dev)
- {
- 	struct i2c_client *client = to_i2c_client(dev);
-@@ -102,7 +86,7 @@ static struct ina2xx_data *ina2xx_update_device(struct device *dev)
- 
- 		/* Read all registers */
- 		for (i = 0; i < data->registers; i++) {
--			int rv = ina2xx_read_word(client, i);
-+			int rv = i2c_smbus_read_word_swapped(client, i);
- 			if (rv < 0) {
- 				ret = ERR_PTR(rv);
- 				goto abort;
-@@ -279,22 +263,26 @@ static int ina2xx_probe(struct i2c_client *client,
- 	switch (data->kind) {
- 	case ina219:
- 		/* device configuration */
--		ina2xx_write_word(client, INA2XX_CONFIG, INA219_CONFIG_DEFAULT);
-+		i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
-+					     INA219_CONFIG_DEFAULT);
- 
- 		/* set current LSB to 1mA, shunt is in uOhms */
- 		/* (equation 13 in datasheet) */
--		ina2xx_write_word(client, INA2XX_CALIBRATION, 40960000 / shunt);
-+		i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
-+					     40960000 / shunt);
- 		dev_info(&client->dev,
- 			 "power monitor INA219 (Rshunt = %li uOhm)\n", shunt);
- 		data->registers = INA219_REGISTERS;
- 		break;
- 	case ina226:
- 		/* device configuration */
--		ina2xx_write_word(client, INA2XX_CONFIG, INA226_CONFIG_DEFAULT);
-+		i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
-+					     INA226_CONFIG_DEFAULT);
- 
- 		/* set current LSB to 1mA, shunt is in uOhms */
- 		/* (equation 1 in datasheet)*/
--		ina2xx_write_word(client, INA2XX_CALIBRATION, 5120000 / shunt);
-+		i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
-+					     5120000 / shunt);
- 		dev_info(&client->dev,
- 			 "power monitor INA226 (Rshunt = %li uOhm)\n", shunt);
- 		data->registers = INA226_REGISTERS;
-diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
-index 0018c7d..1a174f0 100644
---- a/drivers/hwmon/twl4030-madc-hwmon.c
-+++ b/drivers/hwmon/twl4030-madc-hwmon.c
-@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device *dev,
- 			 struct device_attribute *devattr, char *buf)
- {
- 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
--	struct twl4030_madc_request req;
-+	struct twl4030_madc_request req = {
-+		.channels = 1 << attr->index,
-+		.method = TWL4030_MADC_SW2,
-+		.type = TWL4030_MADC_WAIT,
-+	};
- 	long val;
- 
--	req.channels = (1 << attr->index);
--	req.method = TWL4030_MADC_SW2;
--	req.func_cb = NULL;
- 	val = twl4030_madc_conversion(&req);
- 	if (val < 0)
- 		return val;
-diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
-index 31c47e1..5285f85 100644
---- a/drivers/i2c/busses/i2c-powermac.c
-+++ b/drivers/i2c/busses/i2c-powermac.c
-@@ -227,28 +227,138 @@ static int __devexit i2c_powermac_remove(struct platform_device *dev)
- 	return 0;
- }
- 
-+static u32 __devinit i2c_powermac_get_addr(struct i2c_adapter *adap,
-+					   struct pmac_i2c_bus *bus,
-+					   struct device_node *node)
-+{
-+	const __be32 *prop;
-+	int len;
-+
-+	/* First check for valid "reg" */
-+	prop = of_get_property(node, "reg", &len);
-+	if (prop && (len >= sizeof(int)))
-+		return (be32_to_cpup(prop) & 0xff) >> 1;
-+
-+	/* Then check old-style "i2c-address" */
-+	prop = of_get_property(node, "i2c-address", &len);
-+	if (prop && (len >= sizeof(int)))
-+		return (be32_to_cpup(prop) & 0xff) >> 1;
-+
-+	/* Now handle some devices with missing "reg" properties */
-+	if (!strcmp(node->name, "cereal"))
-+		return 0x60;
-+	else if (!strcmp(node->name, "deq"))
-+		return 0x34;
-+
-+	dev_warn(&adap->dev, "No i2c address for %s\n", node->full_name);
-+
-+	return 0xffffffff;
-+}
-+
-+static void __devinit i2c_powermac_create_one(struct i2c_adapter *adap,
-+					      const char *type,
-+					      u32 addr)
-+{
-+	struct i2c_board_info info = {};
-+	struct i2c_client *newdev;
-+
-+	strncpy(info.type, type, sizeof(info.type));
-+	info.addr = addr;
-+	newdev = i2c_new_device(adap, &info);
-+	if (!newdev)
-+		dev_err(&adap->dev,
-+			"i2c-powermac: Failure to register missing %s\n",
-+			type);
-+}
-+
-+static void __devinit i2c_powermac_add_missing(struct i2c_adapter *adap,
-+					       struct pmac_i2c_bus *bus,
-+					       bool found_onyx)
-+{
-+	struct device_node *busnode = pmac_i2c_get_bus_node(bus);
-+	int rc;
-+
-+	/* Check for the onyx audio codec */
-+#define ONYX_REG_CONTROL		67
-+	if (of_device_is_compatible(busnode, "k2-i2c") && !found_onyx) {
-+		union i2c_smbus_data data;
-+
-+		rc = i2c_smbus_xfer(adap, 0x46, 0, I2C_SMBUS_READ,
-+				    ONYX_REG_CONTROL, I2C_SMBUS_BYTE_DATA,
-+				    &data);
-+		if (rc >= 0)
-+			i2c_powermac_create_one(adap, "MAC,pcm3052", 0x46);
-+
-+		rc = i2c_smbus_xfer(adap, 0x47, 0, I2C_SMBUS_READ,
-+				    ONYX_REG_CONTROL, I2C_SMBUS_BYTE_DATA,
-+				    &data);
-+		if (rc >= 0)
-+			i2c_powermac_create_one(adap, "MAC,pcm3052", 0x47);
-+	}
-+}
-+
-+static bool __devinit i2c_powermac_get_type(struct i2c_adapter *adap,
-+					    struct device_node *node,
-+					    u32 addr, char *type, int type_size)
-+{
-+	char tmp[16];
-+
-+	/* Note: we to _NOT_ want the standard
-+	 * i2c drivers to match with any of our powermac stuff
-+	 * unless they have been specifically modified to handle
-+	 * it on a case by case basis. For example, for thermal
-+	 * control, things like lm75 etc... shall match with their
-+	 * corresponding windfarm drivers, _NOT_ the generic ones,
-+	 * so we force a prefix of AAPL, onto the modalias to
-+	 * make that happen
-+	 */
-+
-+	/* First try proper modalias */
-+	if (of_modalias_node(node, tmp, sizeof(tmp)) >= 0) {
-+		snprintf(type, type_size, "MAC,%s", tmp);
-+		return true;
-+	}
-+
-+	/* Now look for known workarounds */
-+	if (!strcmp(node->name, "deq")) {
-+		/* Apple uses address 0x34 for TAS3001 and 0x35 for TAS3004 */
-+		if (addr == 0x34) {
-+			snprintf(type, type_size, "MAC,tas3001");
-+			return true;
-+		} else if (addr == 0x35) {
-+			snprintf(type, type_size, "MAC,tas3004");
-+			return true;
-+		}
-+	}
-+
-+	dev_err(&adap->dev, "i2c-powermac: modalias failure"
-+		" on %s\n", node->full_name);
-+	return false;
-+}
-+
- static void __devinit i2c_powermac_register_devices(struct i2c_adapter *adap,
- 						    struct pmac_i2c_bus *bus)
- {
- 	struct i2c_client *newdev;
- 	struct device_node *node;
-+	bool found_onyx = 0;
-+
-+	/*
-+	 * In some cases we end up with the via-pmu node itself, in this
-+	 * case we skip this function completely as the device-tree will
-+	 * not contain anything useful.
-+	 */
-+	if (!strcmp(adap->dev.of_node->name, "via-pmu"))
-+		return;
- 
- 	for_each_child_of_node(adap->dev.of_node, node) {
- 		struct i2c_board_info info = {};
--		struct dev_archdata dev_ad = {};
--		const __be32 *reg;
--		char tmp[16];
- 		u32 addr;
--		int len;
- 
- 		/* Get address & channel */
--		reg = of_get_property(node, "reg", &len);
--		if (!reg || (len < sizeof(int))) {
--			dev_err(&adap->dev, "i2c-powermac: invalid reg on %s\n",
--				node->full_name);
-+		addr = i2c_powermac_get_addr(adap, bus, node);
-+		if (addr == 0xffffffff)
- 			continue;
--		}
--		addr = be32_to_cpup(reg);
- 
- 		/* Multibus setup, check channel */
- 		if (!pmac_i2c_match_adapter(node, adap))
-@@ -257,27 +367,23 @@ static void __devinit i2c_powermac_register_devices(struct i2c_adapter *adap,
- 		dev_dbg(&adap->dev, "i2c-powermac: register %s\n",
- 			node->full_name);
- 
--		/* Make up a modalias. Note: we to _NOT_ want the standard
--		 * i2c drivers to match with any of our powermac stuff
--		 * unless they have been specifically modified to handle
--		 * it on a case by case basis. For example, for thermal
--		 * control, things like lm75 etc... shall match with their
--		 * corresponding windfarm drivers, _NOT_ the generic ones,
--		 * so we force a prefix of AAPL, onto the modalias to
--		 * make that happen
-+		/*
-+		 * Keep track of some device existence to handle
-+		 * workarounds later.
- 		 */
--		if (of_modalias_node(node, tmp, sizeof(tmp)) < 0) {
--			dev_err(&adap->dev, "i2c-powermac: modalias failure"
--				" on %s\n", node->full_name);
-+		if (of_device_is_compatible(node, "pcm3052"))
-+			found_onyx = true;
-+
-+		/* Make up a modalias */
-+		if (!i2c_powermac_get_type(adap, node, addr,
-+					   info.type, sizeof(info.type))) {
- 			continue;
- 		}
--		snprintf(info.type, sizeof(info.type), "MAC,%s", tmp);
- 
- 		/* Fill out the rest of the info structure */
--		info.addr = (addr & 0xff) >> 1;
-+		info.addr = addr;
- 		info.irq = irq_of_parse_and_map(node, 0);
- 		info.of_node = of_node_get(node);
--		info.archdata = &dev_ad;
- 
- 		newdev = i2c_new_device(adap, &info);
- 		if (!newdev) {
-@@ -292,6 +398,9 @@ static void __devinit i2c_powermac_register_devices(struct i2c_adapter *adap,
- 			continue;
- 		}
- 	}
-+
-+	/* Additional workarounds */
-+	i2c_powermac_add_missing(adap, bus, found_onyx);
- }
- 
- static int __devinit i2c_powermac_probe(struct platform_device *dev)
-diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
-index 6918773..d6cc77a 100644
---- a/drivers/input/serio/i8042-x86ia64io.h
-+++ b/drivers/input/serio/i8042-x86ia64io.h
-@@ -335,6 +335,12 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
- 	},
- 	{
- 		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
-+		},
-+	},
-+	{
-+		.matches = {
- 			DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
- 		},
-diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
-index 8b31473..824abc7 100644
---- a/drivers/input/tablet/wacom_sys.c
-+++ b/drivers/input/tablet/wacom_sys.c
-@@ -445,8 +445,7 @@ static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_feat
- 	/* ask to report Wacom data */
- 	if (features->device_type == BTN_TOOL_FINGER) {
- 		/* if it is an MT Tablet PC touch */
--		if (features->type == TABLETPC2FG ||
--		    features->type == MTSCREEN) {
-+		if (features->type > TABLETPC) {
- 			do {
- 				rep_data[0] = 3;
- 				rep_data[1] = 4;
-@@ -465,7 +464,7 @@ static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_feat
- 			} while ((error < 0 || rep_data[1] != 4) &&
- 				 limit++ < WAC_MSG_RETRIES);
- 		}
--	} else if (features->type != TABLETPC &&
-+	} else if (features->type <= BAMBOO_PT &&
- 		   features->type != WIRELESS &&
- 		   features->device_type == BTN_TOOL_PEN) {
- 		do {
-@@ -515,10 +514,7 @@ static int wacom_retrieve_hid_descriptor(struct usb_interface *intf,
- 	}
- 
- 	/* only devices that support touch need to retrieve the info */
--	if (features->type != TABLETPC &&
--	    features->type != TABLETPC2FG &&
--	    features->type != BAMBOO_PT &&
--	    features->type != MTSCREEN) {
-+	if (features->type < BAMBOO_PT) {
- 		goto out;
- 	}
- 
-diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
-index 869e057..05e8cb3 100644
---- a/drivers/input/tablet/wacom_wac.c
-+++ b/drivers/input/tablet/wacom_wac.c
-@@ -464,7 +464,7 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
- 		t = (data[6] << 2) | ((data[7] >> 6) & 3);
- 		if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
-                     (features->type >= INTUOS5S && features->type <= INTUOS5L) ||
--		    features->type == WACOM_21UX2 || features->type == WACOM_24HD) {
-+		    (features->type >= WACOM_21UX2 && features->type <= WACOM_24HD)) {
- 			t = (t << 1) | (data[1] & 1);
- 		}
- 		input_report_abs(input, ABS_PRESSURE, t);
-@@ -614,7 +614,7 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
- 				input_report_abs(input, ABS_MISC, 0);
- 			}
- 		} else {
--			if (features->type == WACOM_21UX2) {
-+			if (features->type == WACOM_21UX2 || features->type == WACOM_22HD) {
- 				input_report_key(input, BTN_0, (data[5] & 0x01));
- 				input_report_key(input, BTN_1, (data[6] & 0x01));
- 				input_report_key(input, BTN_2, (data[6] & 0x02));
-@@ -633,6 +633,12 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
- 				input_report_key(input, BTN_Z, (data[8] & 0x20));
- 				input_report_key(input, BTN_BASE, (data[8] & 0x40));
- 				input_report_key(input, BTN_BASE2, (data[8] & 0x80));
-+
-+				if (features->type == WACOM_22HD) {
-+					input_report_key(input, KEY_PROG1, data[9] & 0x01);
-+					input_report_key(input, KEY_PROG2, data[9] & 0x02);
-+					input_report_key(input, KEY_PROG3, data[9] & 0x04);
-+				}
- 			} else {
- 				input_report_key(input, BTN_0, (data[5] & 0x01));
- 				input_report_key(input, BTN_1, (data[5] & 0x02));
-@@ -1230,6 +1236,7 @@ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len)
- 	case CINTIQ:
- 	case WACOM_BEE:
- 	case WACOM_21UX2:
-+	case WACOM_22HD:
- 	case WACOM_24HD:
- 		sync = wacom_intuos_irq(wacom_wac);
- 		break;
-@@ -1317,10 +1324,8 @@ void wacom_setup_device_quirks(struct wacom_features *features)
- 	}
- 
- 	/* these device have multiple inputs */
--	if (features->type == TABLETPC || features->type == TABLETPC2FG ||
--	    features->type == BAMBOO_PT || features->type == WIRELESS ||
--	    (features->type >= INTUOS5S && features->type <= INTUOS5L) ||
--	    features->type == MTSCREEN)
-+	if (features->type >= WIRELESS ||
-+	    (features->type >= INTUOS5S && features->type <= INTUOS5L))
- 		features->quirks |= WACOM_QUIRK_MULTI_INPUT;
- 
- 	/* quirk for bamboo touch with 2 low res touches */
-@@ -1432,6 +1437,12 @@ int wacom_setup_input_capabilities(struct input_dev *input_dev,
- 		wacom_setup_cintiq(wacom_wac);
- 		break;
- 
-+	case WACOM_22HD:
-+		__set_bit(KEY_PROG1, input_dev->keybit);
-+		__set_bit(KEY_PROG2, input_dev->keybit);
-+		__set_bit(KEY_PROG3, input_dev->keybit);
-+		/* fall through */
-+
- 	case WACOM_21UX2:
- 		__set_bit(BTN_A, input_dev->keybit);
- 		__set_bit(BTN_B, input_dev->keybit);
-@@ -1855,6 +1866,9 @@ static const struct wacom_features wacom_features_0xF0 =
- static const struct wacom_features wacom_features_0xCC =
- 	{ "Wacom Cintiq 21UX2",   WACOM_PKGLEN_INTUOS,    87200, 65600, 2047,
- 	  63, WACOM_21UX2, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
-+static const struct wacom_features wacom_features_0xFA =
-+	{ "Wacom Cintiq 22HD",    WACOM_PKGLEN_INTUOS,    95840, 54260, 2047,
-+	  63, WACOM_22HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
- static const struct wacom_features wacom_features_0x90 =
- 	{ "Wacom ISDv4 90",       WACOM_PKGLEN_GRAPHIRE,  26202, 16325,  255,
- 	  0, TABLETPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
-@@ -2064,6 +2078,7 @@ const struct usb_device_id wacom_ids[] = {
- 	{ USB_DEVICE_WACOM(0xEC) },
- 	{ USB_DEVICE_WACOM(0x47) },
- 	{ USB_DEVICE_WACOM(0xF4) },
-+	{ USB_DEVICE_WACOM(0xFA) },
- 	{ USB_DEVICE_LENOVO(0x6004) },
- 	{ }
- };
-diff --git a/drivers/input/tablet/wacom_wac.h b/drivers/input/tablet/wacom_wac.h
-index 78fbd3f..9ae9118 100644
---- a/drivers/input/tablet/wacom_wac.h
-+++ b/drivers/input/tablet/wacom_wac.h
-@@ -62,8 +62,6 @@ enum {
- 	PTU,
- 	PL,
- 	DTU,
--	BAMBOO_PT,
--	WIRELESS,
- 	INTUOS,
- 	INTUOS3S,
- 	INTUOS3,
-@@ -74,12 +72,15 @@ enum {
- 	INTUOS5S,
- 	INTUOS5,
- 	INTUOS5L,
--	WACOM_24HD,
- 	WACOM_21UX2,
-+	WACOM_22HD,
-+	WACOM_24HD,
- 	CINTIQ,
- 	WACOM_BEE,
- 	WACOM_MO,
--	TABLETPC,
-+	WIRELESS,
-+	BAMBOO_PT,
-+	TABLETPC,   /* add new TPC below */
- 	TABLETPC2FG,
- 	MTSCREEN,
- 	MAX_TYPE
-diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
-index 6d34706..55fe60d 100644
---- a/drivers/iommu/intel_irq_remapping.c
-+++ b/drivers/iommu/intel_irq_remapping.c
-@@ -736,6 +736,7 @@ int __init parse_ioapics_under_ir(void)
- {
- 	struct dmar_drhd_unit *drhd;
- 	int ir_supported = 0;
-+	int ioapic_idx;
- 
- 	for_each_drhd_unit(drhd) {
- 		struct intel_iommu *iommu = drhd->iommu;
-@@ -748,13 +749,20 @@ int __init parse_ioapics_under_ir(void)
- 		}
- 	}
- 
--	if (ir_supported && ir_ioapic_num != nr_ioapics) {
--		printk(KERN_WARNING
--		       "Not all IO-APIC's listed under remapping hardware\n");
--		return -1;
-+	if (!ir_supported)
-+		return 0;
-+
-+	for (ioapic_idx = 0; ioapic_idx < nr_ioapics; ioapic_idx++) {
-+		int ioapic_id = mpc_ioapic_id(ioapic_idx);
-+		if (!map_ioapic_to_ir(ioapic_id)) {
-+			pr_err(FW_BUG "ioapic %d has no mapping iommu, "
-+			       "interrupt remapping will be disabled\n",
-+			       ioapic_id);
-+			return -1;
-+		}
- 	}
- 
--	return ir_supported;
-+	return 1;
- }
- 
- int __init ir_dev_scope_init(void)
-diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
-index fa6ca47..dceaec8 100644
---- a/drivers/isdn/hardware/mISDN/avmfritz.c
-+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
-@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
- 	switch (cmd) {
- 	case CLOSE_CHANNEL:
- 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
-+		cancel_work_sync(&bch->workq);
- 		spin_lock_irqsave(&fc->lock, flags);
--		mISDN_freebchannel(bch);
-+		mISDN_clear_bchannel(bch);
- 		modehdlc(bch, ISDN_P_NONE);
- 		spin_unlock_irqrestore(&fc->lock, flags);
- 		ch->protocol = ISDN_P_NONE;
-diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
-index 752e082..ccd7d85 100644
---- a/drivers/isdn/hardware/mISDN/mISDNipac.c
-+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
-@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
- 	switch (cmd) {
- 	case CLOSE_CHANNEL:
- 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
-+		cancel_work_sync(&bch->workq);
- 		spin_lock_irqsave(hx->ip->hwlock, flags);
--		mISDN_freebchannel(bch);
-+		mISDN_clear_bchannel(bch);
- 		hscx_mode(hx, ISDN_P_NONE);
- 		spin_unlock_irqrestore(hx->ip->hwlock, flags);
- 		ch->protocol = ISDN_P_NONE;
-diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
-index be5973d..182ecf0 100644
---- a/drivers/isdn/hardware/mISDN/mISDNisar.c
-+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
-@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
- 	switch (cmd) {
- 	case CLOSE_CHANNEL:
- 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
-+		cancel_work_sync(&bch->workq);
- 		spin_lock_irqsave(ich->is->hwlock, flags);
--		mISDN_freebchannel(bch);
-+		mISDN_clear_bchannel(bch);
- 		modeisar(ich, ISDN_P_NONE);
- 		spin_unlock_irqrestore(ich->is->hwlock, flags);
- 		ch->protocol = ISDN_P_NONE;
-diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
-index c3e3e76..9bcade5 100644
---- a/drivers/isdn/hardware/mISDN/netjet.c
-+++ b/drivers/isdn/hardware/mISDN/netjet.c
-@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
- 	switch (cmd) {
- 	case CLOSE_CHANNEL:
- 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
-+		cancel_work_sync(&bch->workq);
- 		spin_lock_irqsave(&card->lock, flags);
--		mISDN_freebchannel(bch);
-+		mISDN_clear_bchannel(bch);
- 		mode_tiger(bc, ISDN_P_NONE);
- 		spin_unlock_irqrestore(&card->lock, flags);
- 		ch->protocol = ISDN_P_NONE;
-diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
-index 26a86b8..335fe64 100644
---- a/drivers/isdn/hardware/mISDN/w6692.c
-+++ b/drivers/isdn/hardware/mISDN/w6692.c
-@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32 cmd, void *arg)
- 	switch (cmd) {
- 	case CLOSE_CHANNEL:
- 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
-+		cancel_work_sync(&bch->workq);
- 		spin_lock_irqsave(&card->lock, flags);
--		mISDN_freebchannel(bch);
-+		mISDN_clear_bchannel(bch);
- 		w6692_mode(bc, ISDN_P_NONE);
- 		spin_unlock_irqrestore(&card->lock, flags);
- 		ch->protocol = ISDN_P_NONE;
-diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
-index 5405ec6..baf2686 100644
---- a/drivers/isdn/isdnloop/isdnloop.c
-+++ b/drivers/isdn/isdnloop/isdnloop.c
-@@ -16,7 +16,6 @@
- #include <linux/sched.h>
- #include "isdnloop.h"
- 
--static char *revision = "$Revision: 1.11.6.7 $";
- static char *isdnloop_id = "loop0";
- 
- MODULE_DESCRIPTION("ISDN4Linux: Pseudo Driver that simulates an ISDN card");
-@@ -1494,17 +1493,6 @@ isdnloop_addcard(char *id1)
- static int __init
- isdnloop_init(void)
- {
--	char *p;
--	char rev[10];
--
--	if ((p = strchr(revision, ':'))) {
--		strcpy(rev, p + 1);
--		p = strchr(rev, '$');
--		*p = 0;
--	} else
--		strcpy(rev, " ??? ");
--	printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
--
- 	if (isdnloop_id)
- 		return (isdnloop_addcard(isdnloop_id));
- 
-diff --git a/drivers/isdn/mISDN/hwchannel.c b/drivers/isdn/mISDN/hwchannel.c
-index ef34fd4..2602be2 100644
---- a/drivers/isdn/mISDN/hwchannel.c
-+++ b/drivers/isdn/mISDN/hwchannel.c
-@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch)
- 	ch->next_minlen = ch->init_minlen;
- 	ch->maxlen = ch->init_maxlen;
- 	ch->next_maxlen = ch->init_maxlen;
-+	skb_queue_purge(&ch->rqueue);
-+	ch->rcount = 0;
- }
- EXPORT_SYMBOL(mISDN_clear_bchannel);
- 
--int
-+void
- mISDN_freebchannel(struct bchannel *ch)
- {
-+	cancel_work_sync(&ch->workq);
- 	mISDN_clear_bchannel(ch);
--	skb_queue_purge(&ch->rqueue);
--	ch->rcount = 0;
--	flush_work_sync(&ch->workq);
--	return 0;
- }
- EXPORT_SYMBOL(mISDN_freebchannel);
- 
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index d5ab449..6fc0c26 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -1157,8 +1157,11 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
- 			ret = 0;
- 	}
- 	rdev->sectors = rdev->sb_start;
--	/* Limit to 4TB as metadata cannot record more than that */
--	if (rdev->sectors >= (2ULL << 32))
-+	/* Limit to 4TB as metadata cannot record more than that.
-+	 * (not needed for Linear and RAID0 as metadata doesn't
-+	 * record this size)
-+	 */
-+	if (rdev->sectors >= (2ULL << 32) && sb->level >= 1)
- 		rdev->sectors = (2ULL << 32) - 2;
- 
- 	if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
-@@ -1449,7 +1452,7 @@ super_90_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors)
- 	/* Limit to 4TB as metadata cannot record more than that.
- 	 * 4TB == 2^32 KB, or 2*2^32 sectors.
- 	 */
--	if (num_sectors >= (2ULL << 32))
-+	if (num_sectors >= (2ULL << 32) && rdev->mddev->level >= 1)
- 		num_sectors = (2ULL << 32) - 2;
- 	md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
- 		       rdev->sb_page);
-@@ -7669,6 +7672,8 @@ static int remove_and_add_spares(struct mddev *mddev)
- 			}
- 		}
- 	}
-+	if (removed)
-+		set_bit(MD_CHANGE_DEVS, &mddev->flags);
- 	return spares;
- }
- 
-@@ -7682,9 +7687,11 @@ static void reap_sync_thread(struct mddev *mddev)
- 	    !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
- 		/* success...*/
- 		/* activate any spares */
--		if (mddev->pers->spare_active(mddev))
-+		if (mddev->pers->spare_active(mddev)) {
- 			sysfs_notify(&mddev->kobj, NULL,
- 				     "degraded");
-+			set_bit(MD_CHANGE_DEVS, &mddev->flags);
-+		}
- 	}
- 	if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
- 	    mddev->pers->finish_reshape)
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 8da6282..e987da4 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -645,7 +645,11 @@ static int raid10_mergeable_bvec(struct request_queue *q,
- 		max = biovec->bv_len;
- 
- 	if (mddev->merge_check_needed) {
--		struct r10bio r10_bio;
-+		struct {
-+			struct r10bio r10_bio;
-+			struct r10dev devs[conf->copies];
-+		} on_stack;
-+		struct r10bio *r10_bio = &on_stack.r10_bio;
- 		int s;
- 		if (conf->reshape_progress != MaxSector) {
- 			/* Cannot give any guidance during reshape */
-@@ -653,18 +657,18 @@ static int raid10_mergeable_bvec(struct request_queue *q,
- 				return biovec->bv_len;
- 			return 0;
- 		}
--		r10_bio.sector = sector;
--		raid10_find_phys(conf, &r10_bio);
-+		r10_bio->sector = sector;
-+		raid10_find_phys(conf, r10_bio);
- 		rcu_read_lock();
- 		for (s = 0; s < conf->copies; s++) {
--			int disk = r10_bio.devs[s].devnum;
-+			int disk = r10_bio->devs[s].devnum;
- 			struct md_rdev *rdev = rcu_dereference(
- 				conf->mirrors[disk].rdev);
- 			if (rdev && !test_bit(Faulty, &rdev->flags)) {
- 				struct request_queue *q =
- 					bdev_get_queue(rdev->bdev);
- 				if (q->merge_bvec_fn) {
--					bvm->bi_sector = r10_bio.devs[s].addr
-+					bvm->bi_sector = r10_bio->devs[s].addr
- 						+ rdev->data_offset;
- 					bvm->bi_bdev = rdev->bdev;
- 					max = min(max, q->merge_bvec_fn(
-@@ -676,7 +680,7 @@ static int raid10_mergeable_bvec(struct request_queue *q,
- 				struct request_queue *q =
- 					bdev_get_queue(rdev->bdev);
- 				if (q->merge_bvec_fn) {
--					bvm->bi_sector = r10_bio.devs[s].addr
-+					bvm->bi_sector = r10_bio->devs[s].addr
- 						+ rdev->data_offset;
- 					bvm->bi_bdev = rdev->bdev;
- 					max = min(max, q->merge_bvec_fn(
-@@ -1488,14 +1492,16 @@ static int _enough(struct r10conf *conf, struct geom *geo, int ignore)
- 	do {
- 		int n = conf->copies;
- 		int cnt = 0;
-+		int this = first;
- 		while (n--) {
--			if (conf->mirrors[first].rdev &&
--			    first != ignore)
-+			if (conf->mirrors[this].rdev &&
-+			    this != ignore)
- 				cnt++;
--			first = (first+1) % geo->raid_disks;
-+			this = (this+1) % geo->raid_disks;
- 		}
- 		if (cnt == 0)
- 			return 0;
-+		first = (first + geo->near_copies) % geo->raid_disks;
- 	} while (first != 0);
- 	return 1;
- }
-@@ -4389,14 +4395,18 @@ static int handle_reshape_read_error(struct mddev *mddev,
- {
- 	/* Use sync reads to get the blocks from somewhere else */
- 	int sectors = r10_bio->sectors;
--	struct r10bio r10b;
- 	struct r10conf *conf = mddev->private;
-+	struct {
-+		struct r10bio r10_bio;
-+		struct r10dev devs[conf->copies];
-+	} on_stack;
-+	struct r10bio *r10b = &on_stack.r10_bio;
- 	int slot = 0;
- 	int idx = 0;
- 	struct bio_vec *bvec = r10_bio->master_bio->bi_io_vec;
- 
--	r10b.sector = r10_bio->sector;
--	__raid10_find_phys(&conf->prev, &r10b);
-+	r10b->sector = r10_bio->sector;
-+	__raid10_find_phys(&conf->prev, r10b);
- 
- 	while (sectors) {
- 		int s = sectors;
-@@ -4407,7 +4417,7 @@ static int handle_reshape_read_error(struct mddev *mddev,
- 			s = PAGE_SIZE >> 9;
- 
- 		while (!success) {
--			int d = r10b.devs[slot].devnum;
-+			int d = r10b->devs[slot].devnum;
- 			struct md_rdev *rdev = conf->mirrors[d].rdev;
- 			sector_t addr;
- 			if (rdev == NULL ||
-@@ -4415,7 +4425,7 @@ static int handle_reshape_read_error(struct mddev *mddev,
- 			    !test_bit(In_sync, &rdev->flags))
- 				goto failed;
- 
--			addr = r10b.devs[slot].addr + idx * PAGE_SIZE;
-+			addr = r10b->devs[slot].addr + idx * PAGE_SIZE;
- 			success = sync_page_io(rdev,
- 					       addr,
- 					       s << 9,
-diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
-index 135b1b0..d2effe7 100644
---- a/drivers/md/raid10.h
-+++ b/drivers/md/raid10.h
-@@ -110,7 +110,7 @@ struct r10bio {
- 	 * We choose the number when they are allocated.
- 	 * We sometimes need an extra bio to write to the replacement.
- 	 */
--	struct {
-+	struct r10dev {
- 		struct bio	*bio;
- 		union {
- 			struct bio	*repl_bio; /* used for resync and
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 04348d7..bcd096b 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -380,6 +380,8 @@ static int calc_degraded(struct r5conf *conf)
- 	degraded = 0;
- 	for (i = 0; i < conf->previous_raid_disks; i++) {
- 		struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
-+		if (rdev && test_bit(Faulty, &rdev->flags))
-+			rdev = rcu_dereference(conf->disks[i].replacement);
- 		if (!rdev || test_bit(Faulty, &rdev->flags))
- 			degraded++;
- 		else if (test_bit(In_sync, &rdev->flags))
-@@ -404,6 +406,8 @@ static int calc_degraded(struct r5conf *conf)
- 	degraded2 = 0;
- 	for (i = 0; i < conf->raid_disks; i++) {
- 		struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
-+		if (rdev && test_bit(Faulty, &rdev->flags))
-+			rdev = rcu_dereference(conf->disks[i].replacement);
- 		if (!rdev || test_bit(Faulty, &rdev->flags))
- 			degraded2++;
- 		else if (test_bit(In_sync, &rdev->flags))
-diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
-index 6e16b09..cabc19c 100644
---- a/drivers/media/rc/rc-main.c
-+++ b/drivers/media/rc/rc-main.c
-@@ -775,10 +775,11 @@ static ssize_t show_protocols(struct device *device,
- 	if (dev->driver_type == RC_DRIVER_SCANCODE) {
- 		enabled = dev->rc_map.rc_type;
- 		allowed = dev->allowed_protos;
--	} else {
-+	} else if (dev->raw) {
- 		enabled = dev->raw->enabled_protocols;
- 		allowed = ir_raw_get_allowed_protocols();
--	}
-+	} else
-+		return -ENODEV;
- 
- 	IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
- 		   (long long)allowed,
-diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
-index 87b251a..b9e2000 100644
---- a/drivers/misc/sgi-xp/xpc_uv.c
-+++ b/drivers/misc/sgi-xp/xpc_uv.c
-@@ -18,6 +18,8 @@
- #include <linux/interrupt.h>
- #include <linux/delay.h>
- #include <linux/device.h>
-+#include <linux/cpu.h>
-+#include <linux/module.h>
- #include <linux/err.h>
- #include <linux/slab.h>
- #include <asm/uv/uv_hub.h>
-@@ -59,6 +61,8 @@ static struct xpc_heartbeat_uv *xpc_heartbeat_uv;
- 					 XPC_NOTIFY_MSG_SIZE_UV)
- #define XPC_NOTIFY_IRQ_NAME		"xpc_notify"
- 
-+static int xpc_mq_node = -1;
-+
- static struct xpc_gru_mq_uv *xpc_activate_mq_uv;
- static struct xpc_gru_mq_uv *xpc_notify_mq_uv;
- 
-@@ -109,11 +113,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_uv *mq, int cpu, char *irq_name)
- #if defined CONFIG_X86_64
- 	mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset,
- 			UV_AFFINITY_CPU);
--	if (mq->irq < 0) {
--		dev_err(xpc_part, "uv_setup_irq() returned error=%d\n",
--			-mq->irq);
-+	if (mq->irq < 0)
- 		return mq->irq;
--	}
- 
- 	mq->mmr_value = uv_read_global_mmr64(mmr_pnode, mq->mmr_offset);
- 
-@@ -238,8 +239,9 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
- 	mq->mmr_blade = uv_cpu_to_blade_id(cpu);
- 
- 	nid = cpu_to_node(cpu);
--	page = alloc_pages_exact_node(nid, GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
--				pg_order);
-+	page = alloc_pages_exact_node(nid,
-+				      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
-+				      pg_order);
- 	if (page == NULL) {
- 		dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
- 			"bytes of memory on nid=%d for GRU mq\n", mq_size, nid);
-@@ -1731,9 +1733,50 @@ static struct xpc_arch_operations xpc_arch_ops_uv = {
- 	.notify_senders_of_disconnect = xpc_notify_senders_of_disconnect_uv,
- };
- 
-+static int
-+xpc_init_mq_node(int nid)
-+{
-+	int cpu;
-+
-+	get_online_cpus();
-+
-+	for_each_cpu(cpu, cpumask_of_node(nid)) {
-+		xpc_activate_mq_uv =
-+			xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, nid,
-+					     XPC_ACTIVATE_IRQ_NAME,
-+					     xpc_handle_activate_IRQ_uv);
-+		if (!IS_ERR(xpc_activate_mq_uv))
-+			break;
-+	}
-+	if (IS_ERR(xpc_activate_mq_uv)) {
-+		put_online_cpus();
-+		return PTR_ERR(xpc_activate_mq_uv);
-+	}
-+
-+	for_each_cpu(cpu, cpumask_of_node(nid)) {
-+		xpc_notify_mq_uv =
-+			xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, nid,
-+					     XPC_NOTIFY_IRQ_NAME,
-+					     xpc_handle_notify_IRQ_uv);
-+		if (!IS_ERR(xpc_notify_mq_uv))
-+			break;
-+	}
-+	if (IS_ERR(xpc_notify_mq_uv)) {
-+		xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
-+		put_online_cpus();
-+		return PTR_ERR(xpc_notify_mq_uv);
-+	}
-+
-+	put_online_cpus();
-+	return 0;
-+}
-+
- int
- xpc_init_uv(void)
- {
-+	int nid;
-+	int ret = 0;
-+
- 	xpc_arch_ops = xpc_arch_ops_uv;
- 
- 	if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
-@@ -1742,21 +1785,21 @@ xpc_init_uv(void)
- 		return -E2BIG;
- 	}
- 
--	xpc_activate_mq_uv = xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, 0,
--						  XPC_ACTIVATE_IRQ_NAME,
--						  xpc_handle_activate_IRQ_uv);
--	if (IS_ERR(xpc_activate_mq_uv))
--		return PTR_ERR(xpc_activate_mq_uv);
-+	if (xpc_mq_node < 0)
-+		for_each_online_node(nid) {
-+			ret = xpc_init_mq_node(nid);
- 
--	xpc_notify_mq_uv = xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, 0,
--						XPC_NOTIFY_IRQ_NAME,
--						xpc_handle_notify_IRQ_uv);
--	if (IS_ERR(xpc_notify_mq_uv)) {
--		xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
--		return PTR_ERR(xpc_notify_mq_uv);
--	}
-+			if (!ret)
-+				break;
-+		}
-+	else
-+		ret = xpc_init_mq_node(xpc_mq_node);
- 
--	return 0;
-+	if (ret < 0)
-+		dev_err(xpc_part, "xpc_init_mq_node() returned error=%d\n",
-+			-ret);
-+
-+	return ret;
- }
- 
- void
-@@ -1765,3 +1808,6 @@ xpc_exit_uv(void)
- 	xpc_destroy_gru_mq_uv(xpc_notify_mq_uv);
- 	xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
- }
-+
-+module_param(xpc_mq_node, int, 0);
-+MODULE_PARM_DESC(xpc_mq_node, "Node number on which to allocate message queues.");
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 276d21c..7b66292 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -1429,7 +1429,8 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
- 		/* complete ongoing async transfer before issuing discard */
- 		if (card->host->areq)
- 			mmc_blk_issue_rw_rq(mq, NULL);
--		if (req->cmd_flags & REQ_SECURE)
-+		if (req->cmd_flags & REQ_SECURE &&
-+			!(card->quirks & MMC_QUIRK_SEC_ERASE_TRIM_BROKEN))
- 			ret = mmc_blk_issue_secdiscard_rq(mq, req);
- 		else
- 			ret = mmc_blk_issue_discard_rq(mq, req);
-@@ -1734,6 +1735,7 @@ force_ro_fail:
- #define CID_MANFID_SANDISK	0x2
- #define CID_MANFID_TOSHIBA	0x11
- #define CID_MANFID_MICRON	0x13
-+#define CID_MANFID_SAMSUNG	0x15
- 
- static const struct mmc_fixup blk_fixups[] =
- {
-@@ -1770,6 +1772,28 @@ static const struct mmc_fixup blk_fixups[] =
- 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
- 		  MMC_QUIRK_LONG_READ_TIME),
- 
-+	/*
-+	 * On these Samsung MoviNAND parts, performing secure erase or
-+	 * secure trim can result in unrecoverable corruption due to a
-+	 * firmware bug.
-+	 */
-+	MMC_FIXUP("M8G2FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("MAG4FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("MBG8FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("MCGAFA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("VAL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("VYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("KYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+	MMC_FIXUP("VZL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
-+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
-+
- 	END_FIXUP
- };
- 
-diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
-index f2c115e..1a69c63 100644
---- a/drivers/mmc/host/atmel-mci.c
-+++ b/drivers/mmc/host/atmel-mci.c
-@@ -81,6 +81,7 @@ struct atmel_mci_caps {
- 	bool	has_bad_data_ordering;
- 	bool	need_reset_after_xfer;
- 	bool	need_blksz_mul_4;
-+	bool	need_notbusy_for_read_ops;
- };
- 
- struct atmel_mci_dma {
-@@ -1619,7 +1620,8 @@ static void atmci_tasklet_func(unsigned long priv)
- 				__func__);
- 			atmci_set_completed(host, EVENT_XFER_COMPLETE);
- 
--			if (host->data->flags & MMC_DATA_WRITE) {
-+			if (host->caps.need_notbusy_for_read_ops ||
-+			   (host->data->flags & MMC_DATA_WRITE)) {
- 				atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY);
- 				state = STATE_WAITING_NOTBUSY;
- 			} else if (host->mrq->stop) {
-@@ -2212,6 +2214,7 @@ static void __init atmci_get_cap(struct atmel_mci *host)
- 	host->caps.has_bad_data_ordering = 1;
- 	host->caps.need_reset_after_xfer = 1;
- 	host->caps.need_blksz_mul_4 = 1;
-+	host->caps.need_notbusy_for_read_ops = 0;
- 
- 	/* keep only major version number */
- 	switch (version & 0xf00) {
-@@ -2232,6 +2235,7 @@ static void __init atmci_get_cap(struct atmel_mci *host)
- 	case 0x200:
- 		host->caps.has_rwproof = 1;
- 		host->caps.need_blksz_mul_4 = 0;
-+		host->caps.need_notbusy_for_read_ops = 1;
- 	case 0x100:
- 		host->caps.has_bad_data_ordering = 0;
- 		host->caps.need_reset_after_xfer = 0;
-diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
-index 277161d..e1fd2c8 100644
---- a/drivers/mmc/host/mxs-mmc.c
-+++ b/drivers/mmc/host/mxs-mmc.c
-@@ -278,11 +278,11 @@ static irqreturn_t mxs_mmc_irq_handler(int irq, void *dev_id)
- 	writel(stat & MXS_MMC_IRQ_BITS,
- 	       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_CLR);
- 
-+	spin_unlock(&host->lock);
-+
- 	if ((stat & BM_SSP_CTRL1_SDIO_IRQ) && (stat & BM_SSP_CTRL1_SDIO_IRQ_EN))
- 		mmc_signal_sdio_irq(host->mmc);
- 
--	spin_unlock(&host->lock);
--
- 	if (stat & BM_SSP_CTRL1_RESP_TIMEOUT_IRQ)
- 		cmd->error = -ETIMEDOUT;
- 	else if (stat & BM_SSP_CTRL1_RESP_ERR_IRQ)
-@@ -637,11 +637,6 @@ static void mxs_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
- 		       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
- 		writel(BM_SSP_CTRL1_SDIO_IRQ_EN,
- 		       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_SET);
--
--		if (readl(host->base + HW_SSP_STATUS(host)) &
--				BM_SSP_STATUS_SDIO_IRQ)
--			mmc_signal_sdio_irq(host->mmc);
--
- 	} else {
- 		writel(BM_SSP_CTRL0_SDIO_IRQ_CHECK,
- 		       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
-@@ -650,6 +645,11 @@ static void mxs_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
- 	}
- 
- 	spin_unlock_irqrestore(&host->lock, flags);
-+
-+	if (enable && readl(host->base + HW_SSP_STATUS(host)) &
-+			BM_SSP_STATUS_SDIO_IRQ)
-+		mmc_signal_sdio_irq(host->mmc);
-+
- }
- 
- static const struct mmc_host_ops mxs_mmc_ops = {
-diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
-index b97b2f5..d25f9ab 100644
---- a/drivers/mmc/host/sdhci-esdhc.h
-+++ b/drivers/mmc/host/sdhci-esdhc.h
-@@ -48,14 +48,14 @@ static inline void esdhc_set_clock(struct sdhci_host *host, unsigned int clock)
- 	int div = 1;
- 	u32 temp;
- 
-+	if (clock == 0)
-+		goto out;
-+
- 	temp = sdhci_readl(host, ESDHC_SYSTEM_CONTROL);
- 	temp &= ~(ESDHC_CLOCK_IPGEN | ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN
- 		| ESDHC_CLOCK_MASK);
- 	sdhci_writel(host, temp, ESDHC_SYSTEM_CONTROL);
- 
--	if (clock == 0)
--		goto out;
--
- 	while (host->max_clk / pre_div / 16 > clock && pre_div < 256)
- 		pre_div *= 2;
- 
-diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
-index 08c893c..e7823dd 100644
---- a/drivers/net/can/janz-ican3.c
-+++ b/drivers/net/can/janz-ican3.c
-@@ -1250,7 +1250,6 @@ static irqreturn_t ican3_irq(int irq, void *dev_id)
-  */
- static int ican3_reset_module(struct ican3_dev *mod)
- {
--	u8 val = 1 << mod->num;
- 	unsigned long start;
- 	u8 runold, runnew;
- 
-@@ -1264,8 +1263,7 @@ static int ican3_reset_module(struct ican3_dev *mod)
- 	runold = ioread8(mod->dpm + TARGET_RUNNING);
- 
- 	/* reset the module */
--	iowrite8(val, &mod->ctrl->reset_assert);
--	iowrite8(val, &mod->ctrl->reset_deassert);
-+	iowrite8(0x00, &mod->dpmctrl->hwreset);
- 
- 	/* wait until the module has finished resetting and is running */
- 	start = jiffies;
-diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
-index 346785c..9d60742 100644
---- a/drivers/net/can/mcp251x.c
-+++ b/drivers/net/can/mcp251x.c
-@@ -83,6 +83,11 @@
- #define INSTRUCTION_LOAD_TXB(n)	(0x40 + 2 * (n))
- #define INSTRUCTION_READ_RXB(n)	(((n) == 0) ? 0x90 : 0x94)
- #define INSTRUCTION_RESET	0xC0
-+#define RTS_TXB0		0x01
-+#define RTS_TXB1		0x02
-+#define RTS_TXB2		0x04
-+#define INSTRUCTION_RTS(n)	(0x80 | ((n) & 0x07))
-+
- 
- /* MPC251x registers */
- #define CANSTAT	      0x0e
-@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf,
- static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
- 			  int tx_buf_idx)
- {
-+	struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
- 	u32 sid, eid, exide, rtr;
- 	u8 buf[SPI_TRANSFER_BUF_LEN];
- 
-@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
- 	buf[TXBDLC_OFF] = (rtr << DLC_RTR_SHIFT) | frame->can_dlc;
- 	memcpy(buf + TXBDAT_OFF, frame->data, frame->can_dlc);
- 	mcp251x_hw_tx_frame(spi, buf, frame->can_dlc, tx_buf_idx);
--	mcp251x_write_reg(spi, TXBCTRL(tx_buf_idx), TXBCTRL_TXREQ);
-+
-+	/* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
-+	priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
-+	mcp251x_spi_trans(priv->spi, 1);
- }
- 
- static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
-diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
-index 4accd7e..5ec2700 100644
---- a/drivers/net/can/ti_hecc.c
-+++ b/drivers/net/can/ti_hecc.c
-@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(struct platform_device *pdev)
- 	struct net_device *ndev = platform_get_drvdata(pdev);
- 	struct ti_hecc_priv *priv = netdev_priv(ndev);
- 
-+	unregister_candev(ndev);
- 	clk_disable(priv->clk);
- 	clk_put(priv->clk);
- 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- 	iounmap(priv->base);
- 	release_mem_region(res->start, resource_size(res));
--	unregister_candev(ndev);
- 	free_candev(ndev);
- 	platform_set_drvdata(pdev, NULL);
- 
-diff --git a/drivers/net/ethernet/cirrus/cs89x0.c b/drivers/net/ethernet/cirrus/cs89x0.c
-index 845b202..1384469 100644
---- a/drivers/net/ethernet/cirrus/cs89x0.c
-+++ b/drivers/net/ethernet/cirrus/cs89x0.c
-@@ -1243,6 +1243,7 @@ static void set_multicast_list(struct net_device *dev)
- {
- 	struct net_local *lp = netdev_priv(dev);
- 	unsigned long flags;
-+	u16 cfg;
- 
- 	spin_lock_irqsave(&lp->lock, flags);
- 	if (dev->flags & IFF_PROMISC)
-@@ -1260,11 +1261,10 @@ static void set_multicast_list(struct net_device *dev)
- 	/* in promiscuous mode, we accept errored packets,
- 	 * so we have to enable interrupts on them also
- 	 */
--	writereg(dev, PP_RxCFG,
--		 (lp->curr_rx_cfg |
--		  (lp->rx_mode == RX_ALL_ACCEPT)
--		  ? (RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL)
--		  : 0));
-+	cfg = lp->curr_rx_cfg;
-+	if (lp->rx_mode == RX_ALL_ACCEPT)
-+		cfg |= RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL;
-+	writereg(dev, PP_RxCFG, cfg);
- 	spin_unlock_irqrestore(&lp->lock, flags);
- }
- 
-diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
-index ab1d80f..7f0183e 100644
---- a/drivers/net/ethernet/freescale/gianfar.c
-+++ b/drivers/net/ethernet/freescale/gianfar.c
-@@ -1037,7 +1037,7 @@ static int gfar_probe(struct platform_device *ofdev)
- 
- 	if (priv->device_flags & FSL_GIANFAR_DEV_HAS_VLAN) {
- 		dev->hw_features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
--		dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-+		dev->features |= NETIF_F_HW_VLAN_RX;
- 	}
- 
- 	if (priv->device_flags & FSL_GIANFAR_DEV_HAS_EXTENDED_HASH) {
-diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
-index 8a02557..4ca75ee 100644
---- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
-+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
-@@ -1741,6 +1741,7 @@ static int gfar_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
- }
- 
- int gfar_phc_index = -1;
-+EXPORT_SYMBOL(gfar_phc_index);
- 
- static int gfar_get_ts_info(struct net_device *dev,
- 			    struct ethtool_ts_info *info)
-diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
-index c08e5d4..0daa66b 100644
---- a/drivers/net/ethernet/freescale/gianfar_ptp.c
-+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
-@@ -515,7 +515,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
- 		err = PTR_ERR(etsects->clock);
- 		goto no_clock;
- 	}
--	gfar_phc_clock = ptp_clock_index(etsects->clock);
-+	gfar_phc_index = ptp_clock_index(etsects->clock);
- 
- 	dev_set_drvdata(&dev->dev, etsects);
- 
-@@ -539,7 +539,7 @@ static int gianfar_ptp_remove(struct platform_device *dev)
- 	gfar_write(&etsects->regs->tmr_temask, 0);
- 	gfar_write(&etsects->regs->tmr_ctrl,   0);
- 
--	gfar_phc_clock = -1;
-+	gfar_phc_index = -1;
- 	ptp_clock_unregister(etsects->clock);
- 	iounmap(etsects->regs);
- 	release_resource(etsects->rsrc);
-diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
-index 9010cea..b68d28a 100644
---- a/drivers/net/ethernet/ibm/ibmveth.c
-+++ b/drivers/net/ethernet/ibm/ibmveth.c
-@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
- 	}
- 
- 	if (adapter->rx_queue.queue_addr != NULL) {
--		if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
--			dma_unmap_single(dev,
--					adapter->rx_queue.queue_dma,
--					adapter->rx_queue.queue_len,
--					DMA_BIDIRECTIONAL);
--			adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
--		}
--		kfree(adapter->rx_queue.queue_addr);
-+		dma_free_coherent(dev, adapter->rx_queue.queue_len,
-+				  adapter->rx_queue.queue_addr,
-+				  adapter->rx_queue.queue_dma);
- 		adapter->rx_queue.queue_addr = NULL;
- 	}
- 
-@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_device *netdev)
- 		goto err_out;
- 	}
- 
-+	dev = &adapter->vdev->dev;
-+
- 	adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
- 						rxq_entries;
--	adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
--						GFP_KERNEL);
-+	adapter->rx_queue.queue_addr =
-+	    dma_alloc_coherent(dev, adapter->rx_queue.queue_len,
-+			       &adapter->rx_queue.queue_dma, GFP_KERNEL);
- 
- 	if (!adapter->rx_queue.queue_addr) {
- 		netdev_err(netdev, "unable to allocate rx queue pages\n");
-@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_device *netdev)
- 		goto err_out;
- 	}
- 
--	dev = &adapter->vdev->dev;
--
- 	adapter->buffer_list_dma = dma_map_single(dev,
- 			adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL);
- 	adapter->filter_list_dma = dma_map_single(dev,
- 			adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL);
--	adapter->rx_queue.queue_dma = dma_map_single(dev,
--			adapter->rx_queue.queue_addr,
--			adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL);
- 
- 	if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
--	    (dma_mapping_error(dev, adapter->filter_list_dma)) ||
--	    (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
-+	    (dma_mapping_error(dev, adapter->filter_list_dma))) {
- 		netdev_err(netdev, "unable to map filter or buffer list "
- 			   "pages\n");
- 		rc = -ENOMEM;
-diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
-index b95f2e1..16c4634 100644
---- a/drivers/net/ethernet/sfc/efx.c
-+++ b/drivers/net/ethernet/sfc/efx.c
-@@ -1503,6 +1503,11 @@ static int efx_probe_all(struct efx_nic *efx)
- 		goto fail2;
- 	}
- 
-+	BUILD_BUG_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_RXQ_MIN_ENT);
-+	if (WARN_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_TXQ_MIN_ENT(efx))) {
-+		rc = -EINVAL;
-+		goto fail3;
-+	}
- 	efx->rxq_entries = efx->txq_entries = EFX_DEFAULT_DMAQ_SIZE;
- 
- 	rc = efx_probe_filters(efx);
-@@ -2070,6 +2075,7 @@ static int efx_register_netdev(struct efx_nic *efx)
- 	net_dev->irq = efx->pci_dev->irq;
- 	net_dev->netdev_ops = &efx_netdev_ops;
- 	SET_ETHTOOL_OPS(net_dev, &efx_ethtool_ops);
-+	net_dev->gso_max_segs = EFX_TSO_MAX_SEGS;
- 
- 	rtnl_lock();
- 
-diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
-index be8f915..70755c9 100644
---- a/drivers/net/ethernet/sfc/efx.h
-+++ b/drivers/net/ethernet/sfc/efx.h
-@@ -30,6 +30,7 @@ extern netdev_tx_t
- efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
- extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
- extern int efx_setup_tc(struct net_device *net_dev, u8 num_tc);
-+extern unsigned int efx_tx_max_skb_descs(struct efx_nic *efx);
- 
- /* RX */
- extern int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
-@@ -52,10 +53,15 @@ extern void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
- #define EFX_MAX_EVQ_SIZE 16384UL
- #define EFX_MIN_EVQ_SIZE 512UL
- 
--/* The smallest [rt]xq_entries that the driver supports. Callers of
-- * efx_wake_queue() assume that they can subsequently send at least one
-- * skb. Falcon/A1 may require up to three descriptors per skb_frag. */
--#define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS))
-+/* Maximum number of TCP segments we support for soft-TSO */
-+#define EFX_TSO_MAX_SEGS	100
-+
-+/* The smallest [rt]xq_entries that the driver supports.  RX minimum
-+ * is a bit arbitrary.  For TX, we must have space for at least 2
-+ * TSO skbs.
-+ */
-+#define EFX_RXQ_MIN_ENT		128U
-+#define EFX_TXQ_MIN_ENT(efx)	(2 * efx_tx_max_skb_descs(efx))
- 
- /* Filters */
- extern int efx_probe_filters(struct efx_nic *efx);
-diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
-index 03ded36..b1287f8 100644
---- a/drivers/net/ethernet/sfc/ethtool.c
-+++ b/drivers/net/ethernet/sfc/ethtool.c
-@@ -680,21 +680,27 @@ static int efx_ethtool_set_ringparam(struct net_device *net_dev,
- 				     struct ethtool_ringparam *ring)
- {
- 	struct efx_nic *efx = netdev_priv(net_dev);
-+	u32 txq_entries;
- 
- 	if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
- 	    ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
- 	    ring->tx_pending > EFX_MAX_DMAQ_SIZE)
- 		return -EINVAL;
- 
--	if (ring->rx_pending < EFX_MIN_RING_SIZE ||
--	    ring->tx_pending < EFX_MIN_RING_SIZE) {
-+	if (ring->rx_pending < EFX_RXQ_MIN_ENT) {
- 		netif_err(efx, drv, efx->net_dev,
--			  "TX and RX queues cannot be smaller than %ld\n",
--			  EFX_MIN_RING_SIZE);
-+			  "RX queues cannot be smaller than %u\n",
-+			  EFX_RXQ_MIN_ENT);
- 		return -EINVAL;
- 	}
- 
--	return efx_realloc_channels(efx, ring->rx_pending, ring->tx_pending);
-+	txq_entries = max(ring->tx_pending, EFX_TXQ_MIN_ENT(efx));
-+	if (txq_entries != ring->tx_pending)
-+		netif_warn(efx, drv, efx->net_dev,
-+			   "increasing TX queue size to minimum of %u\n",
-+			   txq_entries);
-+
-+	return efx_realloc_channels(efx, ring->rx_pending, txq_entries);
- }
- 
- static int efx_ethtool_set_pauseparam(struct net_device *net_dev,
-@@ -857,8 +863,8 @@ static int efx_ethtool_get_class_rule(struct efx_nic *efx,
- 				       &ip_entry->ip4dst, &ip_entry->pdst);
- 	if (rc != 0) {
- 		rc = efx_filter_get_ipv4_full(
--			&spec, &proto, &ip_entry->ip4src, &ip_entry->psrc,
--			&ip_entry->ip4dst, &ip_entry->pdst);
-+			&spec, &proto, &ip_entry->ip4dst, &ip_entry->pdst,
-+			&ip_entry->ip4src, &ip_entry->psrc);
- 		EFX_WARN_ON_PARANOID(rc);
- 		ip_mask->ip4src = ~0;
- 		ip_mask->psrc = ~0;
-diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
-index 94d0365..305430d 100644
---- a/drivers/net/ethernet/sfc/tx.c
-+++ b/drivers/net/ethernet/sfc/tx.c
-@@ -119,6 +119,25 @@ efx_max_tx_len(struct efx_nic *efx, dma_addr_t dma_addr)
- 	return len;
- }
- 
-+unsigned int efx_tx_max_skb_descs(struct efx_nic *efx)
-+{
-+	/* Header and payload descriptor for each output segment, plus
-+	 * one for every input fragment boundary within a segment
-+	 */
-+	unsigned int max_descs = EFX_TSO_MAX_SEGS * 2 + MAX_SKB_FRAGS;
-+
-+	/* Possibly one more per segment for the alignment workaround */
-+	if (EFX_WORKAROUND_5391(efx))
-+		max_descs += EFX_TSO_MAX_SEGS;
-+
-+	/* Possibly more for PCIe page boundaries within input fragments */
-+	if (PAGE_SIZE > EFX_PAGE_SIZE)
-+		max_descs += max_t(unsigned int, MAX_SKB_FRAGS,
-+				   DIV_ROUND_UP(GSO_MAX_SIZE, EFX_PAGE_SIZE));
-+
-+	return max_descs;
-+}
-+
- /*
-  * Add a socket buffer to a TX queue
-  *
-diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
-index f9347ea..63ffbdf 100644
---- a/drivers/net/netconsole.c
-+++ b/drivers/net/netconsole.c
-@@ -648,7 +648,6 @@ static int netconsole_netdev_event(struct notifier_block *this,
- 							  flags);
- 					dev_put(nt->np.dev);
- 					nt->np.dev = NULL;
--					netconsole_target_put(nt);
- 				}
- 				nt->enabled = 0;
- 				stopped = true;
-diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
-index 1c98321..162464f 100644
---- a/drivers/net/ppp/pptp.c
-+++ b/drivers/net/ppp/pptp.c
-@@ -189,7 +189,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
- 	if (sk_pppox(po)->sk_state & PPPOX_DEAD)
- 		goto tx_error;
- 
--	rt = ip_route_output_ports(&init_net, &fl4, NULL,
-+	rt = ip_route_output_ports(sock_net(sk), &fl4, NULL,
- 				   opt->dst_addr.sin_addr.s_addr,
- 				   opt->src_addr.sin_addr.s_addr,
- 				   0, 0, IPPROTO_GRE,
-@@ -468,7 +468,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
- 	po->chan.private = sk;
- 	po->chan.ops = &pptp_chan_ops;
- 
--	rt = ip_route_output_ports(&init_net, &fl4, sk,
-+	rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
- 				   opt->dst_addr.sin_addr.s_addr,
- 				   opt->src_addr.sin_addr.s_addr,
- 				   0, 0,
-diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
-index 3ae80ec..ebcb7d4 100644
---- a/drivers/net/usb/asix.c
-+++ b/drivers/net/usb/asix.c
-@@ -1604,6 +1604,10 @@ static const struct usb_device_id	products [] = {
- 	USB_DEVICE (0x2001, 0x3c05),
- 	.driver_info = (unsigned long) &ax88772_info,
- }, {
-+       // DLink DUB-E100 H/W Ver C1
-+       USB_DEVICE (0x2001, 0x1a02),
-+       .driver_info = (unsigned long) &ax88772_info,
-+}, {
- 	// Linksys USB1000
- 	USB_DEVICE (0x1737, 0x0039),
- 	.driver_info = (unsigned long) &ax88178_info,
-diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
-index a051ced..d124bdd 100644
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -444,6 +444,15 @@ static const struct usb_device_id products[] = {
- 		.bInterfaceProtocol = 0xff,
- 		.driver_info        = (unsigned long)&qmi_wwan_shared,
- 	},
-+	{	/* Pantech UML290 - newer firmware */
-+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-+		.idVendor           = 0x106c,
-+		.idProduct          = 0x3718,
-+		.bInterfaceClass    = 0xff,
-+		.bInterfaceSubClass = 0xf1,
-+		.bInterfaceProtocol = 0xff,
-+		.driver_info        = (unsigned long)&qmi_wwan_shared,
-+	},
- 	{	/* ZTE MF820D */
- 		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
- 		.idVendor           = 0x19d2,
-@@ -453,6 +462,15 @@ static const struct usb_device_id products[] = {
- 		.bInterfaceProtocol = 0xff,
- 		.driver_info        = (unsigned long)&qmi_wwan_force_int4,
- 	},
-+	{	/* ZTE MF821D */
-+		.match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-+		.idVendor           = 0x19d2,
-+		.idProduct          = 0x0326,
-+		.bInterfaceClass    = 0xff,
-+		.bInterfaceSubClass = 0xff,
-+		.bInterfaceProtocol = 0xff,
-+		.driver_info        = (unsigned long)&qmi_wwan_force_int4,
-+	},
- 	{	/* ZTE (Vodafone) K3520-Z */
- 		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
- 		.idVendor           = 0x19d2,
-@@ -507,6 +525,15 @@ static const struct usb_device_id products[] = {
- 		.bInterfaceProtocol = 0xff,
- 		.driver_info        = (unsigned long)&qmi_wwan_force_int4,
- 	},
-+	{	/* ZTE (Vodafone) K5006-Z */
-+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-+		.idVendor           = 0x19d2,
-+		.idProduct          = 0x1018,
-+		.bInterfaceClass    = 0xff,
-+		.bInterfaceSubClass = 0xff,
-+		.bInterfaceProtocol = 0xff,
-+		.driver_info        = (unsigned long)&qmi_wwan_force_int3,
-+	},
- 	{	/* ZTE MF60 */
- 		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
- 		.idVendor           = 0x19d2,
-@@ -525,6 +552,33 @@ static const struct usb_device_id products[] = {
- 		.bInterfaceProtocol = 0xff,
- 		.driver_info        = (unsigned long)&qmi_wwan_sierra,
- 	},
-+	{	/* Sierra Wireless MC7700 */
-+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-+		.idVendor           = 0x0f3d,
-+		.idProduct          = 0x68a2,
-+		.bInterfaceClass    = 0xff,
-+		.bInterfaceSubClass = 0xff,
-+		.bInterfaceProtocol = 0xff,
-+		.driver_info        = (unsigned long)&qmi_wwan_sierra,
-+	},
-+	{	/* Sierra Wireless MC7750 */
-+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-+		.idVendor           = 0x114f,
-+		.idProduct          = 0x68a2,
-+		.bInterfaceClass    = 0xff,
-+		.bInterfaceSubClass = 0xff,
-+		.bInterfaceProtocol = 0xff,
-+		.driver_info        = (unsigned long)&qmi_wwan_sierra,
-+	},
-+	{	/* Sierra Wireless EM7700 */
-+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
-+		.idVendor           = 0x1199,
-+		.idProduct          = 0x901c,
-+		.bInterfaceClass    = 0xff,
-+		.bInterfaceSubClass = 0xff,
-+		.bInterfaceProtocol = 0xff,
-+		.driver_info        = (unsigned long)&qmi_wwan_sierra,
-+	},
- 
- 	/* Gobi 1000 devices */
- 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
-@@ -552,6 +606,8 @@ static const struct usb_device_id products[] = {
- 	{QMI_GOBI_DEVICE(0x05c6, 0x9265)},	/* Asus Gobi 2000 Modem device (VR305) */
- 	{QMI_GOBI_DEVICE(0x05c6, 0x9235)},	/* Top Global Gobi 2000 Modem device (VR306) */
- 	{QMI_GOBI_DEVICE(0x05c6, 0x9275)},	/* iRex Technologies Gobi 2000 Modem device (VR307) */
-+	{QMI_GOBI_DEVICE(0x1199, 0x68a5)},	/* Sierra Wireless Modem */
-+	{QMI_GOBI_DEVICE(0x1199, 0x68a9)},	/* Sierra Wireless Modem */
- 	{QMI_GOBI_DEVICE(0x1199, 0x9001)},	/* Sierra Wireless Gobi 2000 Modem device (VT773) */
- 	{QMI_GOBI_DEVICE(0x1199, 0x9002)},	/* Sierra Wireless Gobi 2000 Modem device (VT773) */
- 	{QMI_GOBI_DEVICE(0x1199, 0x9003)},	/* Sierra Wireless Gobi 2000 Modem device (VT773) */
-@@ -568,6 +624,8 @@ static const struct usb_device_id products[] = {
- 	{QMI_GOBI_DEVICE(0x1199, 0x9013)},	/* Sierra Wireless Gobi 3000 Modem device (MC8355) */
- 	{QMI_GOBI_DEVICE(0x1199, 0x9015)},	/* Sierra Wireless Gobi 3000 Modem device */
- 	{QMI_GOBI_DEVICE(0x1199, 0x9019)},	/* Sierra Wireless Gobi 3000 Modem device */
-+	{QMI_GOBI_DEVICE(0x1199, 0x901b)},	/* Sierra Wireless MC7770 */
-+
- 	{ }					/* END */
- };
- MODULE_DEVICE_TABLE(usb, products);
-diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
-index d237b3f..f2716a4 100644
---- a/drivers/net/usb/usbnet.c
-+++ b/drivers/net/usb/usbnet.c
-@@ -1204,19 +1204,26 @@ deferred:
- }
- EXPORT_SYMBOL_GPL(usbnet_start_xmit);
- 
--static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
-+static int rx_alloc_submit(struct usbnet *dev, gfp_t flags)
- {
- 	struct urb	*urb;
- 	int		i;
-+	int		ret = 0;
- 
- 	/* don't refill the queue all at once */
- 	for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
- 		urb = usb_alloc_urb(0, flags);
- 		if (urb != NULL) {
--			if (rx_submit(dev, urb, flags) == -ENOLINK)
--				return;
-+			ret = rx_submit(dev, urb, flags);
-+			if (ret)
-+				goto err;
-+		} else {
-+			ret = -ENOMEM;
-+			goto err;
- 		}
- 	}
-+err:
-+	return ret;
- }
- 
- /*-------------------------------------------------------------------------*/
-@@ -1260,7 +1267,8 @@ static void usbnet_bh (unsigned long param)
- 		int	temp = dev->rxq.qlen;
- 
- 		if (temp < RX_QLEN(dev)) {
--			rx_alloc_submit(dev, GFP_ATOMIC);
-+			if (rx_alloc_submit(dev, GFP_ATOMIC) == -ENOLINK)
-+				return;
- 			if (temp != dev->rxq.qlen)
- 				netif_dbg(dev, link, dev->net,
- 					  "rxqlen %d --> %d\n",
-diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
-index 236cb9f..3ae938f 100644
---- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
-+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
-@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode)
- {
- 	char iovbuf[32];
- 	int retcode;
-+	__le32 arp_mode_le;
- 
--	brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
-+	arp_mode_le = cpu_to_le32(arp_mode);
-+	brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf,
-+			sizeof(iovbuf));
- 	retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
- 				   iovbuf, sizeof(iovbuf));
- 	retcode = retcode >= 0 ? 0 : retcode;
-@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable)
- {
- 	char iovbuf[32];
- 	int retcode;
-+	__le32 arp_enable_le;
- 
--	brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
-+	arp_enable_le = cpu_to_le32(arp_enable);
-+
-+	brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4,
- 			iovbuf, sizeof(iovbuf));
- 	retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
- 				   iovbuf, sizeof(iovbuf));
-@@ -802,10 +808,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
- 	char buf[128], *ptr;
- 	u32 dongle_align = drvr->bus_if->align;
- 	u32 glom = 0;
--	u32 roaming = 1;
--	uint bcn_timeout = 3;
--	int scan_assoc_time = 40;
--	int scan_unassoc_time = 40;
-+	__le32 roaming_le = cpu_to_le32(1);
-+	__le32 bcn_timeout_le = cpu_to_le32(3);
-+	__le32 scan_assoc_time_le = cpu_to_le32(40);
-+	__le32 scan_unassoc_time_le = cpu_to_le32(40);
- 	int i;
- 
- 	mutex_lock(&drvr->proto_block);
-@@ -840,14 +846,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
- 
- 	/* Setup timeout if Beacons are lost and roam is off to report
- 		 link down */
--	brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
-+	brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf,
- 		    sizeof(iovbuf));
- 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
- 				  sizeof(iovbuf));
- 
- 	/* Enable/Disable build-in roaming to allowed ext supplicant to take
- 		 of romaing */
--	brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
-+	brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4,
- 		      iovbuf, sizeof(iovbuf));
- 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
- 				  sizeof(iovbuf));
-@@ -859,9 +865,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
- 				  sizeof(iovbuf));
- 
- 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
--			 (char *)&scan_assoc_time, sizeof(scan_assoc_time));
-+		 (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le));
- 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
--			 (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
-+		 (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le));
- 
- 	/* Set and enable ARP offload feature */
- 	brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);
-diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
-index d13ae9c..e360939 100644
---- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
-+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
-@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_scan_params_le *params_le,
- 	params_le->active_time = cpu_to_le32(-1);
- 	params_le->passive_time = cpu_to_le32(-1);
- 	params_le->home_time = cpu_to_le32(-1);
--	if (ssid && ssid->SSID_len)
--		memcpy(&params_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
-+	if (ssid && ssid->SSID_len) {
-+		params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len);
-+		memcpy(&params_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len);
-+	}
- }
- 
- static s32
-diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-index 7f97dec..5000690 100644
---- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
-@@ -128,6 +128,9 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file,
- 	const struct fw_img *img;
- 	size_t bufsz;
- 
-+	if (!iwl_is_ready_rf(priv))
-+		return -EAGAIN;
-+
- 	/* default is to dump the entire data segment */
- 	if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
- 		priv->dbgfs_sram_offset = 0x800000;
-diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
-index e959207..8215fad 100644
---- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
-@@ -355,7 +355,7 @@ int iwl_queue_space(const struct iwl_queue *q);
- /*****************************************************
- * Error handling
- ******************************************************/
--int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display);
-+int iwl_dump_fh(struct iwl_trans *trans, char **buf);
- void iwl_dump_csr(struct iwl_trans *trans);
- 
- /*****************************************************
-diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
-index 08517d3..5e18ff9 100644
---- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
-@@ -559,7 +559,7 @@ static void iwl_irq_handle_error(struct iwl_trans *trans)
- 	}
- 
- 	iwl_dump_csr(trans);
--	iwl_dump_fh(trans, NULL, false);
-+	iwl_dump_fh(trans, NULL);
- 
- 	iwl_op_mode_nic_error(trans->op_mode);
- }
-diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
-index 79c6b91..a1fb025 100644
---- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
-@@ -1437,6 +1437,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
- 	return err;
- 
- err_free_irq:
-+	trans_pcie->irq_requested = false;
- 	free_irq(trans_pcie->irq, trans);
- error:
- 	iwl_free_isr_ict(trans);
-@@ -1654,13 +1655,9 @@ static const char *get_fh_string(int cmd)
- #undef IWL_CMD
- }
- 
--int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
-+int iwl_dump_fh(struct iwl_trans *trans, char **buf)
- {
- 	int i;
--#ifdef CONFIG_IWLWIFI_DEBUG
--	int pos = 0;
--	size_t bufsz = 0;
--#endif
- 	static const u32 fh_tbl[] = {
- 		FH_RSCSR_CHNL0_STTS_WPTR_REG,
- 		FH_RSCSR_CHNL0_RBDCB_BASE_REG,
-@@ -1672,29 +1669,35 @@ int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
- 		FH_TSSR_TX_STATUS_REG,
- 		FH_TSSR_TX_ERROR_REG
- 	};
--#ifdef CONFIG_IWLWIFI_DEBUG
--	if (display) {
--		bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
-+
-+#ifdef CONFIG_IWLWIFI_DEBUGFS
-+	if (buf) {
-+		int pos = 0;
-+		size_t bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
-+
- 		*buf = kmalloc(bufsz, GFP_KERNEL);
- 		if (!*buf)
- 			return -ENOMEM;
-+
- 		pos += scnprintf(*buf + pos, bufsz - pos,
- 				"FH register values:\n");
--		for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
-+
-+		for (i = 0; i < ARRAY_SIZE(fh_tbl); i++)
- 			pos += scnprintf(*buf + pos, bufsz - pos,
- 				"  %34s: 0X%08x\n",
- 				get_fh_string(fh_tbl[i]),
- 				iwl_read_direct32(trans, fh_tbl[i]));
--		}
-+
- 		return pos;
- 	}
- #endif
-+
- 	IWL_ERR(trans, "FH register values:\n");
--	for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
-+	for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++)
- 		IWL_ERR(trans, "  %34s: 0X%08x\n",
- 			get_fh_string(fh_tbl[i]),
- 			iwl_read_direct32(trans, fh_tbl[i]));
--	}
-+
- 	return 0;
- }
- 
-@@ -1989,11 +1992,11 @@ static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
- 					 size_t count, loff_t *ppos)
- {
- 	struct iwl_trans *trans = file->private_data;
--	char *buf;
-+	char *buf = NULL;
- 	int pos = 0;
- 	ssize_t ret = -EFAULT;
- 
--	ret = pos = iwl_dump_fh(trans, &buf, true);
-+	ret = pos = iwl_dump_fh(trans, &buf);
- 	if (buf) {
- 		ret = simple_read_from_buffer(user_buf,
- 					      count, ppos, buf, pos);
-diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
-index 5e6b501..d8594a2 100644
---- a/drivers/net/wireless/rt2x00/rt2400pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
-@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
- static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u32 reg;
- 
- 	/*
- 	 * Allocate eeprom data.
-@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
-+	rt2x00_set_field32(&reg, GPIOCSR_BIT8, 1);
-+	rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt2400pci_probe_hw_mode(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
-index d3a4a68..7564ae9 100644
---- a/drivers/net/wireless/rt2x00/rt2400pci.h
-+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
-@@ -670,6 +670,7 @@
- #define GPIOCSR_BIT5			FIELD32(0x00000020)
- #define GPIOCSR_BIT6			FIELD32(0x00000040)
- #define GPIOCSR_BIT7			FIELD32(0x00000080)
-+#define GPIOCSR_BIT8			FIELD32(0x00000100)
- 
- /*
-  * BBPPCSR: BBP Pin control register.
-diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
-index 136b849..2223e35 100644
---- a/drivers/net/wireless/rt2x00/rt2500pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
-@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
- static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u32 reg;
- 
- 	/*
- 	 * Allocate eeprom data.
-@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
-+	rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
-+	rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt2500pci_probe_hw_mode(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
-index 669aecd..d6e87c0 100644
---- a/drivers/net/wireless/rt2x00/rt2500usb.c
-+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
-@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct rt2x00_dev *rt2x00dev)
- 	u16 reg;
- 
- 	rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
--	return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
-+	return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
- }
- 
- #ifdef CONFIG_RT2X00_LIB_LEDS
-@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
- static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u16 reg;
- 
- 	/*
- 	 * Allocate eeprom data.
-@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
-+	rt2x00_set_field16(&reg, MAC_CSR19_BIT8, 0);
-+	rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt2500usb_probe_hw_mode(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
-index b493306..196bd51 100644
---- a/drivers/net/wireless/rt2x00/rt2500usb.h
-+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
-@@ -189,14 +189,15 @@
-  * MAC_CSR19: GPIO control register.
-  */
- #define MAC_CSR19			0x0426
--#define MAC_CSR19_BIT0			FIELD32(0x0001)
--#define MAC_CSR19_BIT1			FIELD32(0x0002)
--#define MAC_CSR19_BIT2			FIELD32(0x0004)
--#define MAC_CSR19_BIT3			FIELD32(0x0008)
--#define MAC_CSR19_BIT4			FIELD32(0x0010)
--#define MAC_CSR19_BIT5			FIELD32(0x0020)
--#define MAC_CSR19_BIT6			FIELD32(0x0040)
--#define MAC_CSR19_BIT7			FIELD32(0x0080)
-+#define MAC_CSR19_BIT0			FIELD16(0x0001)
-+#define MAC_CSR19_BIT1			FIELD16(0x0002)
-+#define MAC_CSR19_BIT2			FIELD16(0x0004)
-+#define MAC_CSR19_BIT3			FIELD16(0x0008)
-+#define MAC_CSR19_BIT4			FIELD16(0x0010)
-+#define MAC_CSR19_BIT5			FIELD16(0x0020)
-+#define MAC_CSR19_BIT6			FIELD16(0x0040)
-+#define MAC_CSR19_BIT7			FIELD16(0x0080)
-+#define MAC_CSR19_BIT8			FIELD16(0x0100)
- 
- /*
-  * MAC_CSR20: LED control register.
-diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
-index cad25bf..0f26ffb 100644
---- a/drivers/net/wireless/rt2x00/rt2800pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
-@@ -977,6 +977,7 @@ static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
- static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u32 reg;
- 
- 	/*
- 	 * Allocate eeprom data.
-@@ -990,6 +991,14 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
-+	rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
-+	rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt2800_probe_hw_mode(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
-index 6cf3365..6b4226b 100644
---- a/drivers/net/wireless/rt2x00/rt2800usb.c
-+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
-@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
- 	skb_pull(entry->skb, RXINFO_DESC_SIZE);
- 
- 	/*
--	 * FIXME: we need to check for rx_pkt_len validity
-+	 * Check for rx_pkt_len validity. Return if invalid, leaving
-+	 * rxdesc->size zeroed out by the upper level.
- 	 */
-+	if (unlikely(rx_pkt_len == 0 ||
-+			rx_pkt_len > entry->queue->data_size)) {
-+		ERROR(entry->queue->rt2x00dev,
-+			"Bad frame size %d, forcing to 0\n", rx_pkt_len);
-+		return;
-+	}
-+
- 	rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
- 
- 	/*
-@@ -736,6 +744,7 @@ static int rt2800usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
- static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u32 reg;
- 
- 	/*
- 	 * Allocate eeprom data.
-@@ -749,6 +758,14 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
-+	rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
-+	rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt2800_probe_hw_mode(rt2x00dev);
-@@ -1157,6 +1174,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x1690, 0x0744) },
- 	{ USB_DEVICE(0x1690, 0x0761) },
- 	{ USB_DEVICE(0x1690, 0x0764) },
-+	/* ASUS */
-+	{ USB_DEVICE(0x0b05, 0x179d) },
- 	/* Cisco */
- 	{ USB_DEVICE(0x167b, 0x4001) },
- 	/* EnGenius */
-@@ -1222,7 +1241,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x0b05, 0x1760) },
- 	{ USB_DEVICE(0x0b05, 0x1761) },
- 	{ USB_DEVICE(0x0b05, 0x1790) },
--	{ USB_DEVICE(0x0b05, 0x179d) },
- 	/* AzureWave */
- 	{ USB_DEVICE(0x13d3, 0x3262) },
- 	{ USB_DEVICE(0x13d3, 0x3284) },
-diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
-index e5404e5..8ac4482 100644
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -629,7 +629,7 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
- 	 */
- 	if (unlikely(rxdesc.size == 0 ||
- 		     rxdesc.size > entry->queue->data_size)) {
--		WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
-+		ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
- 			rxdesc.size, entry->queue->data_size);
- 		dev_kfree_skb(entry->skb);
- 		goto renew_skb;
-diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
-index 5fb3a2e..02ba3cf 100644
---- a/drivers/net/wireless/rt2x00/rt61pci.c
-+++ b/drivers/net/wireless/rt2x00/rt61pci.c
-@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
- static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u32 reg;
- 
- 	/*
- 	 * Disable power saving.
-@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
-+	rt2x00_set_field32(&reg, MAC_CSR13_BIT13, 1);
-+	rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt61pci_probe_hw_mode(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
-index e3cd6db..8f3da5a 100644
---- a/drivers/net/wireless/rt2x00/rt61pci.h
-+++ b/drivers/net/wireless/rt2x00/rt61pci.h
-@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
- #define MAC_CSR13_BIT10			FIELD32(0x00000400)
- #define MAC_CSR13_BIT11			FIELD32(0x00000800)
- #define MAC_CSR13_BIT12			FIELD32(0x00001000)
-+#define MAC_CSR13_BIT13			FIELD32(0x00002000)
- 
- /*
-  * MAC_CSR14: LED control register.
-diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
-index 77ccbbc..ceb1c4f 100644
---- a/drivers/net/wireless/rt2x00/rt73usb.c
-+++ b/drivers/net/wireless/rt2x00/rt73usb.c
-@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
- static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	int retval;
-+	u32 reg;
- 
- 	/*
- 	 * Allocate eeprom data.
-@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
- 		return retval;
- 
- 	/*
-+	 * Enable rfkill polling by setting GPIO direction of the
-+	 * rfkill switch GPIO pin correctly.
-+	 */
-+	rt2x00usb_register_read(rt2x00dev, MAC_CSR13, &reg);
-+	rt2x00_set_field32(&reg, MAC_CSR13_BIT15, 0);
-+	rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
-+
-+	/*
- 	 * Initialize hw specifications.
- 	 */
- 	retval = rt73usb_probe_hw_mode(rt2x00dev);
-diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
-index 9f6b470..df1cc11 100644
---- a/drivers/net/wireless/rt2x00/rt73usb.h
-+++ b/drivers/net/wireless/rt2x00/rt73usb.h
-@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
- #define MAC_CSR13_BIT10			FIELD32(0x00000400)
- #define MAC_CSR13_BIT11			FIELD32(0x00000800)
- #define MAC_CSR13_BIT12			FIELD32(0x00001000)
-+#define MAC_CSR13_BIT13			FIELD32(0x00002000)
-+#define MAC_CSR13_BIT14			FIELD32(0x00004000)
-+#define MAC_CSR13_BIT15			FIELD32(0x00008000)
- 
- /*
-  * MAC_CSR14: LED control register.
-diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
-index 04c3aef..2925094 100644
---- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
-@@ -117,6 +117,7 @@
- 
- #define CHIP_VER_B			BIT(4)
- #define CHIP_92C_BITMASK		BIT(0)
-+#define CHIP_UNKNOWN			BIT(7)
- #define CHIP_92C_1T2R			0x03
- #define CHIP_92C			0x01
- #define CHIP_88C			0x00
-diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
-index 5c4d9bc..509f661 100644
---- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
-@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_chip_version(struct ieee80211_hw *hw)
- 		version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
- 			   VERSION_A_CHIP_88C;
- 	} else {
--		version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
--			   VERSION_B_CHIP_88C;
-+		version = (enum version_8192c) (CHIP_VER_B |
-+				((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
-+				((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
-+		if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
-+		     CHIP_VER_RTL_MASK)) {
-+			version = (enum version_8192c)(version |
-+				   ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
-+				   ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
-+				   CHIP_VENDOR_UMC));
-+		}
- 	}
- 
- 	switch (version) {
-diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
-index 3aa927f..7d8f964 100644
---- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
-@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
- 
- 	/* request fw */
- 	if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
--	    !IS_92C_SERIAL(rtlhal->version))
-+	    !IS_92C_SERIAL(rtlhal->version)) {
- 		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
--	else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
-+	} else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
- 		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
-+		pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
-+	}
- 
- 	rtlpriv->max_fw_size = 0x4000;
- 	pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
-diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
-index e38f91b..110c777 100644
---- a/drivers/platform/x86/asus-laptop.c
-+++ b/drivers/platform/x86/asus-laptop.c
-@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device *dev,
- 	 * The significance of others is yet to be found.
- 	 * If we don't find the method, we assume the device are present.
- 	 */
--	rv = acpi_evaluate_integer(asus->handle, "HRWS", NULL, &temp);
-+	rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
- 	if (!ACPI_FAILURE(rv))
--		len += sprintf(page + len, "HRWS value         : %#x\n",
-+		len += sprintf(page + len, "HWRS value         : %#x\n",
- 			       (uint) temp);
- 	/*
- 	 * Another value for userspace: the ASYM method returns 0x02 for
-@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
- 	 * The significance of others is yet to be found.
- 	 */
- 	status =
--	    acpi_evaluate_integer(asus->handle, "HRWS", NULL, &hwrs_result);
-+	    acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
- 	if (!ACPI_FAILURE(status))
--		pr_notice("  HRWS returned %x", (int)hwrs_result);
-+		pr_notice("  HWRS returned %x", (int)hwrs_result);
- 
- 	if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
- 		asus->have_rsts = true;
-diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
-index 99a30b5..6de14fd 100644
---- a/drivers/platform/x86/asus-nb-wmi.c
-+++ b/drivers/platform/x86/asus-nb-wmi.c
-@@ -94,6 +94,10 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
- 	{ KE_KEY, 0x8A, { KEY_PROG1 } },
- 	{ KE_KEY, 0x95, { KEY_MEDIA } },
- 	{ KE_KEY, 0x99, { KEY_PHONE } },
-+	{ KE_KEY, 0xA0, { KEY_SWITCHVIDEOMODE } }, /* SDSP HDMI only */
-+	{ KE_KEY, 0xA1, { KEY_SWITCHVIDEOMODE } }, /* SDSP LCD + HDMI */
-+	{ KE_KEY, 0xA2, { KEY_SWITCHVIDEOMODE } }, /* SDSP CRT + HDMI */
-+	{ KE_KEY, 0xA3, { KEY_SWITCHVIDEOMODE } }, /* SDSP TV + HDMI */
- 	{ KE_KEY, 0xb5, { KEY_CALC } },
- 	{ KE_KEY, 0xc4, { KEY_KBDILLUMUP } },
- 	{ KE_KEY, 0xc5, { KEY_KBDILLUMDOWN } },
-diff --git a/drivers/rtc/rtc-rs5c348.c b/drivers/rtc/rtc-rs5c348.c
-index 77074cc..fd5c7af 100644
---- a/drivers/rtc/rtc-rs5c348.c
-+++ b/drivers/rtc/rtc-rs5c348.c
-@@ -122,9 +122,12 @@ rs5c348_rtc_read_time(struct device *dev, struct rtc_time *tm)
- 	tm->tm_min = bcd2bin(rxbuf[RS5C348_REG_MINS] & RS5C348_MINS_MASK);
- 	tm->tm_hour = bcd2bin(rxbuf[RS5C348_REG_HOURS] & RS5C348_HOURS_MASK);
- 	if (!pdata->rtc_24h) {
--		tm->tm_hour %= 12;
--		if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM)
-+		if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM) {
-+			tm->tm_hour -= 20;
-+			tm->tm_hour %= 12;
- 			tm->tm_hour += 12;
-+		} else
-+			tm->tm_hour %= 12;
- 	}
- 	tm->tm_wday = bcd2bin(rxbuf[RS5C348_REG_WDAY] & RS5C348_WDAY_MASK);
- 	tm->tm_mday = bcd2bin(rxbuf[RS5C348_REG_DAY] & RS5C348_DAY_MASK);
-diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
-index c5d06fe..9277d94 100644
---- a/drivers/rtc/rtc-twl.c
-+++ b/drivers/rtc/rtc-twl.c
-@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
- 	if (ret < 0)
- 		goto out1;
- 
-+	/* ensure interrupts are disabled, bootloaders can be strange */
-+	ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
-+	if (ret < 0)
-+		dev_warn(&pdev->dev, "unable to disable interrupt\n");
-+
- 	/* init cached IRQ enable bits */
- 	ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
- 	if (ret < 0)
-diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
-index 86a12b4..3878e62 100644
---- a/drivers/scsi/bnx2i/bnx2i_hwi.c
-+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
-@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
- 	int rc = 0;
- 	u64 mask64;
- 
-+	memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
-+	memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
-+
- 	bnx2i_adjust_qp_size(hba);
- 
- 	iscsi_init.flags =
-diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index 796482b..2b4261c 100644
---- a/drivers/scsi/hpsa.c
-+++ b/drivers/scsi/hpsa.c
-@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct CommandList *cp)
- 	}
- 		break;
- 	case CMD_PROTOCOL_ERR:
-+		cmd->result = DID_ERROR << 16;
- 		dev_warn(&h->pdev->dev, "cp %p has "
--			"protocol error \n", cp);
-+			"protocol error\n", cp);
- 		break;
- 	case CMD_HARDWARE_ERR:
- 		cmd->result = DID_ERROR << 16;
-diff --git a/drivers/scsi/lpfc/Makefile b/drivers/scsi/lpfc/Makefile
-index fe5d396..e2516ba 100644
---- a/drivers/scsi/lpfc/Makefile
-+++ b/drivers/scsi/lpfc/Makefile
-@@ -22,7 +22,9 @@
- ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage
- ccflags-$(GCOV) += -O0
- 
-+ifdef WARNINGS_BECOME_ERRORS
- ccflags-y += -Werror
-+endif
- 
- obj-$(CONFIG_SCSI_LPFC) := lpfc.o
- 
-diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
-index b25757d..9d5a56c 100644
---- a/drivers/scsi/mpt2sas/mpt2sas_base.c
-+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
-@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_ADAPTER *ioc)
- 	u16 message_control;
- 
- 
-+	/* Check whether controller SAS2008 B0 controller,
-+	   if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
-+	if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
-+	    ioc->pdev->revision == 0x01) {
-+		return -EINVAL;
-+	}
-+
- 	base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
- 	if (!base) {
- 		dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
-diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
-index 1b38431..6661610 100644
---- a/drivers/scsi/virtio_scsi.c
-+++ b/drivers/scsi/virtio_scsi.c
-@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scatterlist *sg, unsigned int *p_idx,
- 	int i;
- 
- 	for_each_sg(table->sgl, sg_elem, table->nents, i)
--		sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
-+		sg[idx++] = *sg_elem;
- 
- 	*p_idx = idx;
- }
-diff --git a/drivers/staging/android/android_alarm.h b/drivers/staging/android/android_alarm.h
-index d0cafd6..f2ffd96 100644
---- a/drivers/staging/android/android_alarm.h
-+++ b/drivers/staging/android/android_alarm.h
-@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
- #define ANDROID_ALARM_WAIT                  _IO('a', 1)
- 
- #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
-+#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
-+
- /* Set alarm */
- #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
- #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
--#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
-+#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
- #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
- #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
- #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)
-diff --git a/drivers/staging/comedi/drivers/amplc_pci224.c b/drivers/staging/comedi/drivers/amplc_pci224.c
-index fbf19ca..0def1be 100644
---- a/drivers/staging/comedi/drivers/amplc_pci224.c
-+++ b/drivers/staging/comedi/drivers/amplc_pci224.c
-@@ -1519,6 +1519,13 @@ pci224_attach_pci(struct comedi_device *dev, struct pci_dev *pci_dev)
- 		       dev->minor, DRIVER_NAME);
- 		return -EINVAL;
- 	}
-+	/*
-+	 * Need to 'get' the PCI device to match the 'put' in pci224_detach().
-+	 * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
-+	 * support for manual attachment of PCI devices via pci224_attach()
-+	 * has been removed.
-+	 */
-+	pci_dev_get(pci_dev);
- 	return pci224_attach_common(dev, pci_dev, NULL);
- }
- 
-diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
-index 1f31943..83dae6e 100644
---- a/drivers/staging/comedi/drivers/das08.c
-+++ b/drivers/staging/comedi/drivers/das08.c
-@@ -403,7 +403,7 @@ static const struct das08_board_struct das08_boards[] = {
- 	 .ai = das08_ai_rinsn,
- 	 .ai_nbits = 16,
- 	 .ai_pg = das08_pg_none,
--	 .ai_encoding = das08_encode12,
-+	 .ai_encoding = das08_encode16,
- 	 .ao = das08jr_ao_winsn,
- 	 .ao_nbits = 16,
- 	 .di = das08jr_di_rbits,
-@@ -678,7 +678,7 @@ static int das08jr_ao_winsn(struct comedi_device *dev,
- 	int chan;
- 
- 	lsb = data[0] & 0xff;
--	msb = (data[0] >> 8) & 0xf;
-+	msb = (data[0] >> 8) & 0xff;
- 
- 	chan = CR_CHAN(insn->chanspec);
- 
-diff --git a/drivers/staging/media/lirc/lirc_sir.c b/drivers/staging/media/lirc/lirc_sir.c
-index 945d962..4afc3b4 100644
---- a/drivers/staging/media/lirc/lirc_sir.c
-+++ b/drivers/staging/media/lirc/lirc_sir.c
-@@ -52,6 +52,7 @@
- #include <linux/io.h>
- #include <asm/irq.h>
- #include <linux/fcntl.h>
-+#include <linux/platform_device.h>
- #ifdef LIRC_ON_SA1100
- #include <asm/hardware.h>
- #ifdef CONFIG_SA1100_COLLIE
-@@ -487,9 +488,11 @@ static struct lirc_driver driver = {
- 	.owner		= THIS_MODULE,
- };
- 
-+static struct platform_device *lirc_sir_dev;
- 
- static int init_chrdev(void)
- {
-+	driver.dev = &lirc_sir_dev->dev;
- 	driver.minor = lirc_register_driver(&driver);
- 	if (driver.minor < 0) {
- 		printk(KERN_ERR LIRC_DRIVER_NAME ": init_chrdev() failed.\n");
-@@ -1215,20 +1218,71 @@ static int init_lirc_sir(void)
- 	return 0;
- }
- 
-+static int __devinit lirc_sir_probe(struct platform_device *dev)
-+{
-+	return 0;
-+}
-+
-+static int __devexit lirc_sir_remove(struct platform_device *dev)
-+{
-+	return 0;
-+}
-+
-+static struct platform_driver lirc_sir_driver = {
-+	.probe		= lirc_sir_probe,
-+	.remove		= __devexit_p(lirc_sir_remove),
-+	.driver		= {
-+		.name	= "lirc_sir",
-+		.owner	= THIS_MODULE,
-+	},
-+};
- 
- static int __init lirc_sir_init(void)
- {
- 	int retval;
- 
-+	retval = platform_driver_register(&lirc_sir_driver);
-+	if (retval) {
-+		printk(KERN_ERR LIRC_DRIVER_NAME ": Platform driver register "
-+		       "failed!\n");
-+		return -ENODEV;
-+	}
-+
-+	lirc_sir_dev = platform_device_alloc("lirc_dev", 0);
-+	if (!lirc_sir_dev) {
-+		printk(KERN_ERR LIRC_DRIVER_NAME ": Platform device alloc "
-+		       "failed!\n");
-+		retval = -ENOMEM;
-+		goto pdev_alloc_fail;
-+	}
-+
-+	retval = platform_device_add(lirc_sir_dev);
-+	if (retval) {
-+		printk(KERN_ERR LIRC_DRIVER_NAME ": Platform device add "
-+		       "failed!\n");
-+		retval = -ENODEV;
-+		goto pdev_add_fail;
-+	}
-+
- 	retval = init_chrdev();
- 	if (retval < 0)
--		return retval;
-+		goto fail;
-+
- 	retval = init_lirc_sir();
- 	if (retval) {
- 		drop_chrdev();
--		return retval;
-+		goto fail;
- 	}
-+
- 	return 0;
-+
-+fail:
-+	platform_device_del(lirc_sir_dev);
-+pdev_add_fail:
-+	platform_device_put(lirc_sir_dev);
-+pdev_alloc_fail:
-+	platform_driver_unregister(&lirc_sir_driver);
-+	return retval;
- }
- 
- static void __exit lirc_sir_exit(void)
-@@ -1236,6 +1290,8 @@ static void __exit lirc_sir_exit(void)
- 	drop_hardware();
- 	drop_chrdev();
- 	drop_port();
-+	platform_device_unregister(lirc_sir_dev);
-+	platform_driver_unregister(&lirc_sir_driver);
- 	printk(KERN_INFO LIRC_DRIVER_NAME ": Uninstalled.\n");
- }
- 
-diff --git a/drivers/staging/rtl8712/recv_linux.c b/drivers/staging/rtl8712/recv_linux.c
-index 0e26d5f..495ee12 100644
---- a/drivers/staging/rtl8712/recv_linux.c
-+++ b/drivers/staging/rtl8712/recv_linux.c
-@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adapter *padapter,
- 	if (skb == NULL)
- 		goto _recv_indicatepkt_drop;
- 	skb->data = precv_frame->u.hdr.rx_data;
--#ifdef NET_SKBUFF_DATA_USES_OFFSET
--	skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
--		     precv_frame->u.hdr.rx_head);
--#else
--	skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
--#endif
- 	skb->len = precv_frame->u.hdr.len;
-+	skb_set_tail_pointer(skb, skb->len);
- 	if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
- 		skb->ip_summed = CHECKSUM_UNNECESSARY;
- 	else
-diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
-index 92b34e2..40e2488 100644
---- a/drivers/staging/speakup/main.c
-+++ b/drivers/staging/speakup/main.c
-@@ -1854,7 +1854,7 @@ static void speakup_bits(struct vc_data *vc)
- 
- static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
- {
--	static u_char *goto_buf = "\0\0\0\0\0\0";
-+	static u_char goto_buf[8];
- 	static int num;
- 	int maxlen, go_pos;
- 	char *cp;
-diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
-index e4bdf2a..3aa895e 100644
---- a/drivers/staging/vt6656/dpc.c
-+++ b/drivers/staging/vt6656/dpc.c
-@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
-     } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
-         cbHeaderSize += 6;
-         pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
--	if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
-+	if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
- 	    (*pwType == cpu_to_le16(0xF380))) {
- 		cbHeaderSize -= 8;
-             pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
-diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
-index 9b64b10..fe21868 100644
---- a/drivers/staging/vt6656/rxtx.c
-+++ b/drivers/staging/vt6656/rxtx.c
-@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb(
-     // 802.1H
-     if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
- 	if (pDevice->dwDiagRefCount == 0) {
--		if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
-+		if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
- 		    (psEthHeader->wType == cpu_to_le16(0xF380))) {
- 			memcpy((PBYTE) (pbyPayloadHead),
- 			       abySNAP_Bridgetunnel, 6);
-@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
-     Packet_Type = skb->data[ETH_HLEN+1];
-     Descriptor_type = skb->data[ETH_HLEN+1+1+2];
-     Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
--    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
--	/* 802.1x OR eapol-key challenge frame transfer */
--	if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
--		(Packet_Type == 3)) {
-+	if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
-+		/* 802.1x OR eapol-key challenge frame transfer */
-+		if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
-+			(Packet_Type == 3)) {
-                         bTxeapol_key = TRUE;
-                        if(!(Key_info & BIT3) &&  //WPA or RSN group-key challenge
- 			   (Key_info & BIT8) && (Key_info & BIT9)) {    //send 2/2 key
-@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
-         }
-     }
- 
--    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
--        if (pDevice->byBBType != BB_TYPE_11A) {
--            pDevice->wCurrentRate = RATE_1M;
--            pDevice->byACKRate = RATE_1M;
--            pDevice->byTopCCKBasicRate = RATE_1M;
--            pDevice->byTopOFDMBasicRate = RATE_6M;
--        } else {
--            pDevice->wCurrentRate = RATE_6M;
--            pDevice->byACKRate = RATE_6M;
--            pDevice->byTopCCKBasicRate = RATE_1M;
--            pDevice->byTopOFDMBasicRate = RATE_6M;
--        }
--    }
-+	if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
-+		if (pDevice->byBBType != BB_TYPE_11A) {
-+			pDevice->wCurrentRate = RATE_1M;
-+			pDevice->byACKRate = RATE_1M;
-+			pDevice->byTopCCKBasicRate = RATE_1M;
-+			pDevice->byTopOFDMBasicRate = RATE_6M;
-+		} else {
-+			pDevice->wCurrentRate = RATE_6M;
-+			pDevice->byACKRate = RATE_6M;
-+			pDevice->byTopCCKBasicRate = RATE_1M;
-+			pDevice->byTopOFDMBasicRate = RATE_6M;
-+		}
-+	}
- 
-     DBG_PRT(MSG_LEVEL_DEBUG,
- 	    KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
-@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, unsigned int uDMAIdx, struct sk_buff *skb)
- 
-     if (bNeedEncryption == TRUE) {
-         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
--	if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
-+	if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
- 		bNeedEncryption = FALSE;
-             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
-             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
-diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
-index 784c796..8d30f5c 100644
---- a/drivers/staging/zcache/zcache-main.c
-+++ b/drivers/staging/zcache/zcache-main.c
-@@ -1259,13 +1259,12 @@ static int zcache_pampd_get_data_and_free(char *data, size_t *bufsize, bool raw,
- 					void *pampd, struct tmem_pool *pool,
- 					struct tmem_oid *oid, uint32_t index)
- {
--	int ret = 0;
--
- 	BUG_ON(!is_ephemeral(pool));
--	zbud_decompress((struct page *)(data), pampd);
-+	if (zbud_decompress((struct page *)(data), pampd) < 0)
-+		return -EINVAL;
- 	zbud_free_and_delist((struct zbud_hdr *)pampd);
- 	atomic_dec(&zcache_curr_eph_pampd_count);
--	return ret;
-+	return 0;
- }
- 
- /*
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index df9824c..0981707 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2261,7 +2261,7 @@ out:
- /*
-  * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
-  */
--static int transport_get_sense_data(struct se_cmd *cmd)
-+static void transport_get_sense_data(struct se_cmd *cmd)
- {
- 	unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
- 	struct se_device *dev = cmd->se_dev;
-@@ -2271,30 +2271,15 @@ static int transport_get_sense_data(struct se_cmd *cmd)
- 	WARN_ON(!cmd->se_lun);
- 
- 	if (!dev)
--		return 0;
-+		return;
- 
- 	spin_lock_irqsave(&cmd->t_state_lock, flags);
- 	if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
- 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
--		return 0;
--	}
--
--	if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
--		goto out;
--
--	if (!dev->transport->get_sense_buffer) {
--		pr_err("dev->transport->get_sense_buffer is NULL\n");
--		goto out;
-+		return;
- 	}
- 
- 	sense_buffer = dev->transport->get_sense_buffer(cmd);
--	if (!sense_buffer) {
--		pr_err("ITT 0x%08x cmd %p: Unable to locate"
--			" sense buffer for task with sense\n",
--			cmd->se_tfo->get_task_tag(cmd), cmd);
--		goto out;
--	}
--
- 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
- 
- 	offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
-@@ -2306,11 +2291,6 @@ static int transport_get_sense_data(struct se_cmd *cmd)
- 
- 	pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n",
- 		dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
--	return 0;
--
--out:
--	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
--	return -1;
- }
- 
- static inline long long transport_dev_end_lba(struct se_device *dev)
-@@ -3000,15 +2980,20 @@ static int transport_generic_cmd_sequencer(
- 			/* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
- 			goto out_invalid_cdb_field;
- 		}
--
-+		/*
-+		 * For the overflow case keep the existing fabric provided
-+		 * ->data_length.  Otherwise for the underflow case, reset
-+		 * ->data_length to the smaller SCSI expected data transfer
-+		 * length.
-+		 */
- 		if (size > cmd->data_length) {
- 			cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
- 			cmd->residual_count = (size - cmd->data_length);
- 		} else {
- 			cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
- 			cmd->residual_count = (cmd->data_length - size);
-+			cmd->data_length = size;
- 		}
--		cmd->data_length = size;
- 	}
- 
- 	if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {
-@@ -3166,7 +3151,7 @@ static void transport_handle_queue_full(
- static void target_complete_ok_work(struct work_struct *work)
- {
- 	struct se_cmd *cmd = container_of(work, struct se_cmd, work);
--	int reason = 0, ret;
-+	int ret;
- 
- 	/*
- 	 * Check if we need to move delayed/dormant tasks from cmds on the
-@@ -3187,19 +3172,16 @@ static void target_complete_ok_work(struct work_struct *work)
- 	 * the struct se_cmd in question.
- 	 */
- 	if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
--		if (transport_get_sense_data(cmd) < 0)
--			reason = TCM_NON_EXISTENT_LUN;
--
--		if (cmd->scsi_status) {
--			ret = transport_send_check_condition_and_sense(
--					cmd, reason, 1);
--			if (ret == -EAGAIN || ret == -ENOMEM)
--				goto queue_full;
-+		WARN_ON(!cmd->scsi_status);
-+		transport_get_sense_data(cmd);
-+		ret = transport_send_check_condition_and_sense(
-+					cmd, 0, 1);
-+		if (ret == -EAGAIN || ret == -ENOMEM)
-+			goto queue_full;
- 
--			transport_lun_remove_cmd(cmd);
--			transport_cmd_check_stop_to_fabric(cmd);
--			return;
--		}
-+		transport_lun_remove_cmd(cmd);
-+		transport_cmd_check_stop_to_fabric(cmd);
-+		return;
- 	}
- 	/*
- 	 * Check for a callback, used by amongst other things
-diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
-index 4ef7473..e983331 100644
---- a/drivers/tty/serial/imx.c
-+++ b/drivers/tty/serial/imx.c
-@@ -132,6 +132,7 @@
- #define  UCR4_OREN  	 (1<<1)  /* Receiver overrun interrupt enable */
- #define  UCR4_DREN  	 (1<<0)  /* Recv data ready interrupt enable */
- #define  UFCR_RXTL_SHF   0       /* Receiver trigger level shift */
-+#define  UFCR_DCEDTE	 (1<<6)  /* DCE/DTE mode select */
- #define  UFCR_RFDIV      (7<<7)  /* Reference freq divider mask */
- #define  UFCR_RFDIV_REG(x)	(((x) < 7 ? 6 - (x) : 6) << 7)
- #define  UFCR_TXTL_SHF   10      /* Transmitter trigger level shift */
-@@ -668,22 +669,11 @@ static void imx_break_ctl(struct uart_port *port, int break_state)
- static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
- {
- 	unsigned int val;
--	unsigned int ufcr_rfdiv;
--
--	/* set receiver / transmitter trigger level.
--	 * RFDIV is set such way to satisfy requested uartclk value
--	 */
--	val = TXTL << 10 | RXTL;
--	ufcr_rfdiv = (clk_get_rate(sport->clk_per) + sport->port.uartclk / 2)
--			/ sport->port.uartclk;
--
--	if(!ufcr_rfdiv)
--		ufcr_rfdiv = 1;
--
--	val |= UFCR_RFDIV_REG(ufcr_rfdiv);
- 
-+	/* set receiver / transmitter trigger level */
-+	val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
-+	val |= TXTL << UFCR_TXTL_SHF | RXTL;
- 	writel(val, sport->port.membase + UFCR);
--
- 	return 0;
- }
- 
-@@ -758,6 +748,7 @@ static int imx_startup(struct uart_port *port)
- 		}
- 	}
- 
-+	spin_lock_irqsave(&sport->port.lock, flags);
- 	/*
- 	 * Finally, clear and enable interrupts
- 	 */
-@@ -811,7 +802,6 @@ static int imx_startup(struct uart_port *port)
- 	/*
- 	 * Enable modem status interrupts
- 	 */
--	spin_lock_irqsave(&sport->port.lock,flags);
- 	imx_enable_ms(&sport->port);
- 	spin_unlock_irqrestore(&sport->port.lock,flags);
- 
-@@ -841,10 +831,13 @@ static void imx_shutdown(struct uart_port *port)
- {
- 	struct imx_port *sport = (struct imx_port *)port;
- 	unsigned long temp;
-+	unsigned long flags;
- 
-+	spin_lock_irqsave(&sport->port.lock, flags);
- 	temp = readl(sport->port.membase + UCR2);
- 	temp &= ~(UCR2_TXEN);
- 	writel(temp, sport->port.membase + UCR2);
-+	spin_unlock_irqrestore(&sport->port.lock, flags);
- 
- 	if (USE_IRDA(sport)) {
- 		struct imxuart_platform_data *pdata;
-@@ -873,12 +866,14 @@ static void imx_shutdown(struct uart_port *port)
- 	 * Disable all interrupts, port and break condition.
- 	 */
- 
-+	spin_lock_irqsave(&sport->port.lock, flags);
- 	temp = readl(sport->port.membase + UCR1);
- 	temp &= ~(UCR1_TXMPTYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN);
- 	if (USE_IRDA(sport))
- 		temp &= ~(UCR1_IREN);
- 
- 	writel(temp, sport->port.membase + UCR1);
-+	spin_unlock_irqrestore(&sport->port.lock, flags);
- }
- 
- static void
-@@ -1221,6 +1216,9 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
- 	struct imx_port *sport = imx_ports[co->index];
- 	struct imx_port_ucrs old_ucr;
- 	unsigned int ucr1;
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&sport->port.lock, flags);
- 
- 	/*
- 	 *	First, save UCR1/2/3 and then disable interrupts
-@@ -1246,6 +1244,8 @@ imx_console_write(struct console *co, const char *s, unsigned int count)
- 	while (!(readl(sport->port.membase + USR2) & USR2_TXDC));
- 
- 	imx_port_ucrs_restore(&sport->port, &old_ucr);
-+
-+	spin_unlock_irqrestore(&sport->port.lock, flags);
- }
- 
- /*
-diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
-index 4fdec6a..558ce85 100644
---- a/drivers/tty/serial/pch_uart.c
-+++ b/drivers/tty/serial/pch_uart.c
-@@ -253,6 +253,9 @@ struct eg20t_port {
- 	dma_addr_t			rx_buf_dma;
- 
- 	struct dentry	*debugfs;
-+
-+	/* protect the eg20t_port private structure and io access to membase */
-+	spinlock_t lock;
- };
- 
- /**
-@@ -754,7 +757,8 @@ static void pch_dma_rx_complete(void *arg)
- 		tty_flip_buffer_push(tty);
- 	tty_kref_put(tty);
- 	async_tx_ack(priv->desc_rx);
--	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT);
-+	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT |
-+					    PCH_UART_HAL_RX_ERR_INT);
- }
- 
- static void pch_dma_tx_complete(void *arg)
-@@ -809,7 +813,8 @@ static int handle_rx_to(struct eg20t_port *priv)
- 	int rx_size;
- 	int ret;
- 	if (!priv->start_rx) {
--		pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT);
-+		pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT |
-+						     PCH_UART_HAL_RX_ERR_INT);
- 		return 0;
- 	}
- 	buf = &priv->rxbuf;
-@@ -1058,7 +1063,7 @@ static irqreturn_t pch_uart_interrupt(int irq, void *dev_id)
- 	int next = 1;
- 	u8 msr;
- 
--	spin_lock_irqsave(&priv->port.lock, flags);
-+	spin_lock_irqsave(&priv->lock, flags);
- 	handled = 0;
- 	while (next) {
- 		iid = pch_uart_hal_get_iid(priv);
-@@ -1078,11 +1083,13 @@ static irqreturn_t pch_uart_interrupt(int irq, void *dev_id)
- 		case PCH_UART_IID_RDR:	/* Received Data Ready */
- 			if (priv->use_dma) {
- 				pch_uart_hal_disable_interrupt(priv,
--							PCH_UART_HAL_RX_INT);
-+						PCH_UART_HAL_RX_INT |
-+						PCH_UART_HAL_RX_ERR_INT);
- 				ret = dma_handle_rx(priv);
- 				if (!ret)
- 					pch_uart_hal_enable_interrupt(priv,
--							PCH_UART_HAL_RX_INT);
-+						PCH_UART_HAL_RX_INT |
-+						PCH_UART_HAL_RX_ERR_INT);
- 			} else {
- 				ret = handle_rx(priv);
- 			}
-@@ -1116,7 +1123,7 @@ static irqreturn_t pch_uart_interrupt(int irq, void *dev_id)
- 		handled |= (unsigned int)ret;
- 	}
- 
--	spin_unlock_irqrestore(&priv->port.lock, flags);
-+	spin_unlock_irqrestore(&priv->lock, flags);
- 	return IRQ_RETVAL(handled);
- }
- 
-@@ -1208,7 +1215,8 @@ static void pch_uart_stop_rx(struct uart_port *port)
- 	struct eg20t_port *priv;
- 	priv = container_of(port, struct eg20t_port, port);
- 	priv->start_rx = 0;
--	pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT);
-+	pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT |
-+					     PCH_UART_HAL_RX_ERR_INT);
- }
- 
- /* Enable the modem status interrupts. */
-@@ -1226,9 +1234,9 @@ static void pch_uart_break_ctl(struct uart_port *port, int ctl)
- 	unsigned long flags;
- 
- 	priv = container_of(port, struct eg20t_port, port);
--	spin_lock_irqsave(&port->lock, flags);
-+	spin_lock_irqsave(&priv->lock, flags);
- 	pch_uart_hal_set_break(priv, ctl);
--	spin_unlock_irqrestore(&port->lock, flags);
-+	spin_unlock_irqrestore(&priv->lock, flags);
- }
- 
- /* Grab any interrupt resources and initialise any low level driver state. */
-@@ -1263,6 +1271,7 @@ static int pch_uart_startup(struct uart_port *port)
- 		break;
- 	case 16:
- 		fifo_size = PCH_UART_HAL_FIFO16;
-+		break;
- 	case 1:
- 	default:
- 		fifo_size = PCH_UART_HAL_FIFO_DIS;
-@@ -1300,7 +1309,8 @@ static int pch_uart_startup(struct uart_port *port)
- 		pch_request_dma(port);
- 
- 	priv->start_rx = 1;
--	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT);
-+	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT |
-+					    PCH_UART_HAL_RX_ERR_INT);
- 	uart_update_timeout(port, CS8, default_baud);
- 
- 	return 0;
-@@ -1358,7 +1368,7 @@ static void pch_uart_set_termios(struct uart_port *port,
- 		stb = PCH_UART_HAL_STB1;
- 
- 	if (termios->c_cflag & PARENB) {
--		if (!(termios->c_cflag & PARODD))
-+		if (termios->c_cflag & PARODD)
- 			parity = PCH_UART_HAL_PARITY_ODD;
- 		else
- 			parity = PCH_UART_HAL_PARITY_EVEN;
-@@ -1376,7 +1386,8 @@ static void pch_uart_set_termios(struct uart_port *port,
- 
- 	baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk / 16);
- 
--	spin_lock_irqsave(&port->lock, flags);
-+	spin_lock_irqsave(&priv->lock, flags);
-+	spin_lock(&port->lock);
- 
- 	uart_update_timeout(port, termios->c_cflag, baud);
- 	rtn = pch_uart_hal_set_line(priv, baud, parity, bits, stb);
-@@ -1389,7 +1400,8 @@ static void pch_uart_set_termios(struct uart_port *port,
- 		tty_termios_encode_baud_rate(termios, baud, baud);
- 
- out:
--	spin_unlock_irqrestore(&port->lock, flags);
-+	spin_unlock(&port->lock);
-+	spin_unlock_irqrestore(&priv->lock, flags);
- }
- 
- static const char *pch_uart_type(struct uart_port *port)
-@@ -1538,8 +1550,9 @@ pch_console_write(struct console *co, const char *s, unsigned int count)
- {
- 	struct eg20t_port *priv;
- 	unsigned long flags;
-+	int priv_locked = 1;
-+	int port_locked = 1;
- 	u8 ier;
--	int locked = 1;
- 
- 	priv = pch_uart_ports[co->index];
- 
-@@ -1547,12 +1560,16 @@ pch_console_write(struct console *co, const char *s, unsigned int count)
- 
- 	local_irq_save(flags);
- 	if (priv->port.sysrq) {
--		/* serial8250_handle_port() already took the lock */
--		locked = 0;
-+		spin_lock(&priv->lock);
-+		/* serial8250_handle_port() already took the port lock */
-+		port_locked = 0;
- 	} else if (oops_in_progress) {
--		locked = spin_trylock(&priv->port.lock);
--	} else
-+		priv_locked = spin_trylock(&priv->lock);
-+		port_locked = spin_trylock(&priv->port.lock);
-+	} else {
-+		spin_lock(&priv->lock);
- 		spin_lock(&priv->port.lock);
-+	}
- 
- 	/*
- 	 *	First save the IER then disable the interrupts
-@@ -1570,8 +1587,10 @@ pch_console_write(struct console *co, const char *s, unsigned int count)
- 	wait_for_xmitr(priv, BOTH_EMPTY);
- 	iowrite8(ier, priv->membase + UART_IER);
- 
--	if (locked)
-+	if (port_locked)
- 		spin_unlock(&priv->port.lock);
-+	if (priv_locked)
-+		spin_unlock(&priv->lock);
- 	local_irq_restore(flags);
- }
- 
-@@ -1669,6 +1688,8 @@ static struct eg20t_port *pch_uart_init_port(struct pci_dev *pdev,
- 	pci_enable_msi(pdev);
- 	pci_set_master(pdev);
- 
-+	spin_lock_init(&priv->lock);
-+
- 	iobase = pci_resource_start(pdev, 0);
- 	mapbase = pci_resource_start(pdev, 1);
- 	priv->mapbase = mapbase;
-diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
-index 51f9694..ea271d7 100644
---- a/drivers/usb/chipidea/udc.c
-+++ b/drivers/usb/chipidea/udc.c
-@@ -77,8 +77,7 @@ static inline int ep_to_bit(struct ci13xxx *udc, int n)
- }
- 
- /**
-- * hw_device_state: enables/disables interrupts & starts/stops device (execute
-- *                  without interruption)
-+ * hw_device_state: enables/disables interrupts (execute without interruption)
-  * @dma: 0 => disable, !0 => enable and set dma engine
-  *
-  * This function returns an error code
-@@ -92,7 +91,6 @@ static int hw_device_state(struct ci13xxx *udc, u32 dma)
- 			     USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
- 		hw_write(udc, OP_USBCMD, USBCMD_RS, USBCMD_RS);
- 	} else {
--		hw_write(udc, OP_USBCMD, USBCMD_RS, 0);
- 		hw_write(udc, OP_USBINTR, ~0, 0);
- 	}
- 	return 0;
-@@ -773,10 +771,7 @@ __acquires(mEp->lock)
- {
- 	struct ci13xxx_req *mReq, *mReqTemp;
- 	struct ci13xxx_ep *mEpTemp = mEp;
--	int uninitialized_var(retval);
--
--	if (list_empty(&mEp->qh.queue))
--		return -EINVAL;
-+	int retval = 0;
- 
- 	list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
- 			queue) {
-@@ -1419,6 +1414,21 @@ static int ci13xxx_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
- 	return -ENOTSUPP;
- }
- 
-+/* Change Data+ pullup status
-+ * this func is used by usb_gadget_connect/disconnet
-+ */
-+static int ci13xxx_pullup(struct usb_gadget *_gadget, int is_on)
-+{
-+	struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
-+
-+	if (is_on)
-+		hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
-+	else
-+		hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
-+
-+	return 0;
-+}
-+
- static int ci13xxx_start(struct usb_gadget *gadget,
- 			 struct usb_gadget_driver *driver);
- static int ci13xxx_stop(struct usb_gadget *gadget,
-@@ -1431,6 +1441,7 @@ static int ci13xxx_stop(struct usb_gadget *gadget,
- static const struct usb_gadget_ops usb_gadget_ops = {
- 	.vbus_session	= ci13xxx_vbus_session,
- 	.wakeup		= ci13xxx_wakeup,
-+	.pullup		= ci13xxx_pullup,
- 	.vbus_draw	= ci13xxx_vbus_draw,
- 	.udc_start	= ci13xxx_start,
- 	.udc_stop	= ci13xxx_stop,
-@@ -1454,7 +1465,12 @@ static int init_eps(struct ci13xxx *udc)
- 
- 			mEp->ep.name      = mEp->name;
- 			mEp->ep.ops       = &usb_ep_ops;
--			mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
-+			/*
-+			 * for ep0: maxP defined in desc, for other
-+			 * eps, maxP is set by epautoconfig() called
-+			 * by gadget layer
-+			 */
-+			mEp->ep.maxpacket = (unsigned short)~0;
- 
- 			INIT_LIST_HEAD(&mEp->qh.queue);
- 			mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
-@@ -1474,6 +1490,7 @@ static int init_eps(struct ci13xxx *udc)
- 				else
- 					udc->ep0in = mEp;
- 
-+				mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
- 				continue;
- 			}
- 
-@@ -1483,6 +1500,17 @@ static int init_eps(struct ci13xxx *udc)
- 	return retval;
- }
- 
-+static void destroy_eps(struct ci13xxx *udc)
-+{
-+	int i;
-+
-+	for (i = 0; i < udc->hw_ep_max; i++) {
-+		struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
-+
-+		dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
-+	}
-+}
-+
- /**
-  * ci13xxx_start: register a gadget driver
-  * @gadget: our gadget
-@@ -1692,7 +1720,7 @@ static int udc_start(struct ci13xxx *udc)
- 	if (udc->udc_driver->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
- 		if (udc->transceiver == NULL) {
- 			retval = -ENODEV;
--			goto free_pools;
-+			goto destroy_eps;
- 		}
- 	}
- 
-@@ -1730,7 +1758,7 @@ static int udc_start(struct ci13xxx *udc)
- 
- remove_trans:
- 	if (udc->transceiver) {
--		otg_set_peripheral(udc->transceiver->otg, &udc->gadget);
-+		otg_set_peripheral(udc->transceiver->otg, NULL);
- 		usb_put_transceiver(udc->transceiver);
- 	}
- 
-@@ -1742,6 +1770,8 @@ unreg_device:
- put_transceiver:
- 	if (udc->transceiver)
- 		usb_put_transceiver(udc->transceiver);
-+destroy_eps:
-+	destroy_eps(udc);
- free_pools:
- 	dma_pool_destroy(udc->td_pool);
- free_qh_pool:
-@@ -1756,18 +1786,12 @@ free_qh_pool:
-  */
- static void udc_stop(struct ci13xxx *udc)
- {
--	int i;
--
- 	if (udc == NULL)
- 		return;
- 
- 	usb_del_gadget_udc(&udc->gadget);
- 
--	for (i = 0; i < udc->hw_ep_max; i++) {
--		struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
--
--		dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
--	}
-+	destroy_eps(udc);
- 
- 	dma_pool_destroy(udc->td_pool);
- 	dma_pool_destroy(udc->qh_pool);
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index ee46927..3cc771e 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -134,12 +134,14 @@ static struct usb_driver wdm_driver;
- /* return intfdata if we own the interface, else look up intf in the list */
- static struct wdm_device *wdm_find_device(struct usb_interface *intf)
- {
--	struct wdm_device *desc = NULL;
-+	struct wdm_device *desc;
- 
- 	spin_lock(&wdm_device_list_lock);
- 	list_for_each_entry(desc, &wdm_device_list, device_list)
- 		if (desc->intf == intf)
--			break;
-+			goto found;
-+	desc = NULL;
-+found:
- 	spin_unlock(&wdm_device_list_lock);
- 
- 	return desc;
-@@ -147,12 +149,14 @@ static struct wdm_device *wdm_find_device(struct usb_interface *intf)
- 
- static struct wdm_device *wdm_find_device_by_minor(int minor)
- {
--	struct wdm_device *desc = NULL;
-+	struct wdm_device *desc;
- 
- 	spin_lock(&wdm_device_list_lock);
- 	list_for_each_entry(desc, &wdm_device_list, device_list)
- 		if (desc->intf->minor == minor)
--			break;
-+			goto found;
-+	desc = NULL;
-+found:
- 	spin_unlock(&wdm_device_list_lock);
- 
- 	return desc;
-diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
-index d956965..3440812 100644
---- a/drivers/usb/core/devices.c
-+++ b/drivers/usb/core/devices.c
-@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct file *file, char __user *buf,
- 	/* print devices for all busses */
- 	list_for_each_entry(bus, &usb_bus_list, bus_list) {
- 		/* recurse through all children of the root hub */
--		if (!bus->root_hub)
-+		if (!bus_to_hcd(bus)->rh_registered)
- 			continue;
- 		usb_lock_device(bus->root_hub);
- 		ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
-diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index 190b1ec..6b6891fc 100644
---- a/drivers/usb/core/hcd.c
-+++ b/drivers/usb/core/hcd.c
-@@ -1011,10 +1011,7 @@ static int register_root_hub(struct usb_hcd *hcd)
- 	if (retval) {
- 		dev_err (parent_dev, "can't register root hub for %s, %d\n",
- 				dev_name(&usb_dev->dev), retval);
--	}
--	mutex_unlock(&usb_bus_list_lock);
--
--	if (retval == 0) {
-+	} else {
- 		spin_lock_irq (&hcd_root_hub_lock);
- 		hcd->rh_registered = 1;
- 		spin_unlock_irq (&hcd_root_hub_lock);
-@@ -1023,6 +1020,7 @@ static int register_root_hub(struct usb_hcd *hcd)
- 		if (HCD_DEAD(hcd))
- 			usb_hc_died (hcd);	/* This time clean up */
- 	}
-+	mutex_unlock(&usb_bus_list_lock);
- 
- 	return retval;
- }
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index 32d3adc..8b2a9d8 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -96,6 +96,10 @@ static const struct usb_device_id usb_quirk_list[] = {
- 	{ USB_DEVICE(0x04b4, 0x0526), .driver_info =
- 			USB_QUIRK_CONFIG_INTF_STRINGS },
- 
-+	/* Microchip Joss Optical infrared touchboard device */
-+	{ USB_DEVICE(0x04d8, 0x000c), .driver_info =
-+			USB_QUIRK_CONFIG_INTF_STRINGS },
-+
- 	/* Samsung Android phone modem - ID conflict with SPH-I500 */
- 	{ USB_DEVICE(0x04e8, 0x6601), .driver_info =
- 			USB_QUIRK_CONFIG_INTF_STRINGS },
-diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
-index 1040bdb..6dc9d2f 100644
---- a/drivers/usb/dwc3/core.c
-+++ b/drivers/usb/dwc3/core.c
-@@ -429,16 +429,21 @@ static int __devinit dwc3_probe(struct platform_device *pdev)
- 		dev_err(dev, "missing IRQ\n");
- 		return -ENODEV;
- 	}
--	dwc->xhci_resources[1] = *res;
-+	dwc->xhci_resources[1].start = res->start;
-+	dwc->xhci_resources[1].end = res->end;
-+	dwc->xhci_resources[1].flags = res->flags;
-+	dwc->xhci_resources[1].name = res->name;
- 
- 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- 	if (!res) {
- 		dev_err(dev, "missing memory resource\n");
- 		return -ENODEV;
- 	}
--	dwc->xhci_resources[0] = *res;
-+	dwc->xhci_resources[0].start = res->start;
- 	dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
- 					DWC3_XHCI_REGS_END;
-+	dwc->xhci_resources[0].flags = res->flags;
-+	dwc->xhci_resources[0].name = res->name;
- 
- 	 /*
- 	  * Request memory region but exclude xHCI regs,
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 9e8a3dc..127551c 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -702,7 +702,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
- 		transferred = min_t(u32, ur->length,
- 				transfer_size - length);
- 		memcpy(ur->buf, dwc->ep0_bounce, transferred);
--		dwc->ep0_bounced = false;
- 	} else {
- 		transferred = ur->length - length;
- 	}
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index ec70df7..0b24d9d 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -238,8 +238,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
- 	if (req->request.status == -EINPROGRESS)
- 		req->request.status = status;
- 
--	usb_gadget_unmap_request(&dwc->gadget, &req->request,
--			req->direction);
-+	if (dwc->ep0_bounced && dep->number == 0)
-+		dwc->ep0_bounced = false;
-+	else
-+		usb_gadget_unmap_request(&dwc->gadget, &req->request,
-+				req->direction);
- 
- 	dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n",
- 			req, dep->name, req->request.actual,
-diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
-index 1a4430f..22865dd 100644
---- a/drivers/usb/gadget/at91_udc.c
-+++ b/drivers/usb/gadget/at91_udc.c
-@@ -475,8 +475,7 @@ static int at91_ep_enable(struct usb_ep *_ep,
- 	unsigned long	flags;
- 
- 	if (!_ep || !ep
--			|| !desc || ep->ep.desc
--			|| _ep->name == ep0name
-+			|| !desc || _ep->name == ep0name
- 			|| desc->bDescriptorType != USB_DT_ENDPOINT
- 			|| (maxpacket = usb_endpoint_maxp(desc)) == 0
- 			|| maxpacket > ep->maxpacket) {
-@@ -530,7 +529,6 @@ ok:
- 	tmp |= AT91_UDP_EPEDS;
- 	__raw_writel(tmp, ep->creg);
- 
--	ep->ep.desc = desc;
- 	ep->ep.maxpacket = maxpacket;
- 
- 	/*
-@@ -1634,7 +1632,6 @@ static int at91_start(struct usb_gadget *gadget,
- 	udc = container_of(gadget, struct at91_udc, gadget);
- 	udc->driver = driver;
- 	udc->gadget.dev.driver = &driver->driver;
--	dev_set_drvdata(&udc->gadget.dev, &driver->driver);
- 	udc->enabled = 1;
- 	udc->selfpowered = 1;
- 
-@@ -1655,7 +1652,6 @@ static int at91_stop(struct usb_gadget *gadget,
- 	spin_unlock_irqrestore(&udc->lock, flags);
- 
- 	udc->gadget.dev.driver = NULL;
--	dev_set_drvdata(&udc->gadget.dev, NULL);
- 	udc->driver = NULL;
- 
- 	DBG("unbound from %s\n", driver->driver.name);
-diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
-index b799106..afdbb1c 100644
---- a/drivers/usb/gadget/dummy_hcd.c
-+++ b/drivers/usb/gadget/dummy_hcd.c
-@@ -1916,6 +1916,27 @@ done:
- 	return retval;
- }
- 
-+/* usb 3.0 root hub device descriptor */
-+struct {
-+	struct usb_bos_descriptor bos;
-+	struct usb_ss_cap_descriptor ss_cap;
-+} __packed usb3_bos_desc = {
-+
-+	.bos = {
-+		.bLength		= USB_DT_BOS_SIZE,
-+		.bDescriptorType	= USB_DT_BOS,
-+		.wTotalLength		= cpu_to_le16(sizeof(usb3_bos_desc)),
-+		.bNumDeviceCaps		= 1,
-+	},
-+	.ss_cap = {
-+		.bLength		= USB_DT_USB_SS_CAP_SIZE,
-+		.bDescriptorType	= USB_DT_DEVICE_CAPABILITY,
-+		.bDevCapabilityType	= USB_SS_CAP_TYPE,
-+		.wSpeedSupported	= cpu_to_le16(USB_5GBPS_OPERATION),
-+		.bFunctionalitySupport	= ilog2(USB_5GBPS_OPERATION),
-+	},
-+};
-+
- static inline void
- ss_hub_descriptor(struct usb_hub_descriptor *desc)
- {
-@@ -2006,6 +2027,18 @@ static int dummy_hub_control(
- 		else
- 			hub_descriptor((struct usb_hub_descriptor *) buf);
- 		break;
-+
-+	case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
-+		if (hcd->speed != HCD_USB3)
-+			goto error;
-+
-+		if ((wValue >> 8) != USB_DT_BOS)
-+			goto error;
-+
-+		memcpy(buf, &usb3_bos_desc, sizeof(usb3_bos_desc));
-+		retval = sizeof(usb3_bos_desc);
-+		break;
-+
- 	case GetHubStatus:
- 		*(__le32 *) buf = cpu_to_le32(0);
- 		break;
-@@ -2503,10 +2536,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
- 	hs_hcd->has_tt = 1;
- 
- 	retval = usb_add_hcd(hs_hcd, 0, 0);
--	if (retval != 0) {
--		usb_put_hcd(hs_hcd);
--		return retval;
--	}
-+	if (retval)
-+		goto put_usb2_hcd;
- 
- 	if (mod_data.is_super_speed) {
- 		ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
-@@ -2525,6 +2556,8 @@ static int dummy_hcd_probe(struct platform_device *pdev)
- put_usb3_hcd:
- 	usb_put_hcd(ss_hcd);
- dealloc_usb2_hcd:
-+	usb_remove_hcd(hs_hcd);
-+put_usb2_hcd:
- 	usb_put_hcd(hs_hcd);
- 	the_controller.hs_hcd = the_controller.ss_hcd = NULL;
- 	return retval;
-diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
-index c304354..4a54418 100644
---- a/drivers/usb/host/ehci-omap.c
-+++ b/drivers/usb/host/ehci-omap.c
-@@ -56,15 +56,6 @@
- #define	EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT		8
- #define	EHCI_INSNREG05_ULPI_WRDATA_SHIFT		0
- 
--/* Errata i693 */
--static struct clk	*utmi_p1_fck;
--static struct clk	*utmi_p2_fck;
--static struct clk	*xclk60mhsp1_ck;
--static struct clk	*xclk60mhsp2_ck;
--static struct clk	*usbhost_p1_fck;
--static struct clk	*usbhost_p2_fck;
--static struct clk	*init_60m_fclk;
--
- /*-------------------------------------------------------------------------*/
- 
- static const struct hc_driver ehci_omap_hc_driver;
-@@ -80,40 +71,6 @@ static inline u32 ehci_read(void __iomem *base, u32 reg)
- 	return __raw_readl(base + reg);
- }
- 
--/* Erratum i693 workaround sequence */
--static void omap_ehci_erratum_i693(struct ehci_hcd *ehci)
--{
--	int ret = 0;
--
--	/* Switch to the internal 60 MHz clock */
--	ret = clk_set_parent(utmi_p1_fck, init_60m_fclk);
--	if (ret != 0)
--		ehci_err(ehci, "init_60m_fclk set parent"
--			"failed error:%d\n", ret);
--
--	ret = clk_set_parent(utmi_p2_fck, init_60m_fclk);
--	if (ret != 0)
--		ehci_err(ehci, "init_60m_fclk set parent"
--			"failed error:%d\n", ret);
--
--	clk_enable(usbhost_p1_fck);
--	clk_enable(usbhost_p2_fck);
--
--	/* Wait 1ms and switch back to the external clock */
--	mdelay(1);
--	ret = clk_set_parent(utmi_p1_fck, xclk60mhsp1_ck);
--	if (ret != 0)
--		ehci_err(ehci, "xclk60mhsp1_ck set parent"
--			"failed error:%d\n", ret);
--
--	ret = clk_set_parent(utmi_p2_fck, xclk60mhsp2_ck);
--	if (ret != 0)
--		ehci_err(ehci, "xclk60mhsp2_ck set parent"
--			"failed error:%d\n", ret);
--
--	clk_disable(usbhost_p1_fck);
--	clk_disable(usbhost_p2_fck);
--}
- 
- static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
- {
-@@ -145,50 +102,6 @@ static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
- 	}
- }
- 
--static int omap_ehci_hub_control(
--	struct usb_hcd	*hcd,
--	u16		typeReq,
--	u16		wValue,
--	u16		wIndex,
--	char		*buf,
--	u16		wLength
--)
--{
--	struct ehci_hcd	*ehci = hcd_to_ehci(hcd);
--	u32 __iomem *status_reg = &ehci->regs->port_status[
--				(wIndex & 0xff) - 1];
--	u32		temp;
--	unsigned long	flags;
--	int		retval = 0;
--
--	spin_lock_irqsave(&ehci->lock, flags);
--
--	if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
--		temp = ehci_readl(ehci, status_reg);
--		if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
--			retval = -EPIPE;
--			goto done;
--		}
--
--		temp &= ~PORT_WKCONN_E;
--		temp |= PORT_WKDISC_E | PORT_WKOC_E;
--		ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
--
--		omap_ehci_erratum_i693(ehci);
--
--		set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
--		goto done;
--	}
--
--	spin_unlock_irqrestore(&ehci->lock, flags);
--
--	/* Handle the hub control events here */
--	return ehci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
--done:
--	spin_unlock_irqrestore(&ehci->lock, flags);
--	return retval;
--}
--
- static void disable_put_regulator(
- 		struct ehci_hcd_omap_platform_data *pdata)
- {
-@@ -351,76 +264,9 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
- 	/* root ports should always stay powered */
- 	ehci_port_power(omap_ehci, 1);
- 
--	/* get clocks */
--	utmi_p1_fck = clk_get(dev, "utmi_p1_gfclk");
--	if (IS_ERR(utmi_p1_fck)) {
--		ret = PTR_ERR(utmi_p1_fck);
--		dev_err(dev, "utmi_p1_gfclk failed error:%d\n",	ret);
--		goto err_add_hcd;
--	}
--
--	xclk60mhsp1_ck = clk_get(dev, "xclk60mhsp1_ck");
--	if (IS_ERR(xclk60mhsp1_ck)) {
--		ret = PTR_ERR(xclk60mhsp1_ck);
--		dev_err(dev, "xclk60mhsp1_ck failed error:%d\n", ret);
--		goto err_utmi_p1_fck;
--	}
--
--	utmi_p2_fck = clk_get(dev, "utmi_p2_gfclk");
--	if (IS_ERR(utmi_p2_fck)) {
--		ret = PTR_ERR(utmi_p2_fck);
--		dev_err(dev, "utmi_p2_gfclk failed error:%d\n", ret);
--		goto err_xclk60mhsp1_ck;
--	}
--
--	xclk60mhsp2_ck = clk_get(dev, "xclk60mhsp2_ck");
--	if (IS_ERR(xclk60mhsp2_ck)) {
--		ret = PTR_ERR(xclk60mhsp2_ck);
--		dev_err(dev, "xclk60mhsp2_ck failed error:%d\n", ret);
--		goto err_utmi_p2_fck;
--	}
--
--	usbhost_p1_fck = clk_get(dev, "usb_host_hs_utmi_p1_clk");
--	if (IS_ERR(usbhost_p1_fck)) {
--		ret = PTR_ERR(usbhost_p1_fck);
--		dev_err(dev, "usbhost_p1_fck failed error:%d\n", ret);
--		goto err_xclk60mhsp2_ck;
--	}
--
--	usbhost_p2_fck = clk_get(dev, "usb_host_hs_utmi_p2_clk");
--	if (IS_ERR(usbhost_p2_fck)) {
--		ret = PTR_ERR(usbhost_p2_fck);
--		dev_err(dev, "usbhost_p2_fck failed error:%d\n", ret);
--		goto err_usbhost_p1_fck;
--	}
--
--	init_60m_fclk = clk_get(dev, "init_60m_fclk");
--	if (IS_ERR(init_60m_fclk)) {
--		ret = PTR_ERR(init_60m_fclk);
--		dev_err(dev, "init_60m_fclk failed error:%d\n", ret);
--		goto err_usbhost_p2_fck;
--	}
- 
- 	return 0;
- 
--err_usbhost_p2_fck:
--	clk_put(usbhost_p2_fck);
--
--err_usbhost_p1_fck:
--	clk_put(usbhost_p1_fck);
--
--err_xclk60mhsp2_ck:
--	clk_put(xclk60mhsp2_ck);
--
--err_utmi_p2_fck:
--	clk_put(utmi_p2_fck);
--
--err_xclk60mhsp1_ck:
--	clk_put(xclk60mhsp1_ck);
--
--err_utmi_p1_fck:
--	clk_put(utmi_p1_fck);
--
- err_add_hcd:
- 	disable_put_regulator(pdata);
- 	pm_runtime_put_sync(dev);
-@@ -450,14 +296,6 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
- 	iounmap(hcd->regs);
- 	usb_put_hcd(hcd);
- 
--	clk_put(utmi_p1_fck);
--	clk_put(utmi_p2_fck);
--	clk_put(xclk60mhsp1_ck);
--	clk_put(xclk60mhsp2_ck);
--	clk_put(usbhost_p1_fck);
--	clk_put(usbhost_p2_fck);
--	clk_put(init_60m_fclk);
--
- 	pm_runtime_put_sync(dev);
- 	pm_runtime_disable(dev);
- 
-@@ -528,7 +366,7 @@ static const struct hc_driver ehci_omap_hc_driver = {
- 	 * root hub support
- 	 */
- 	.hub_status_data	= ehci_hub_status_data,
--	.hub_control		= omap_ehci_hub_control,
-+	.hub_control		= ehci_hub_control,
- 	.bus_suspend		= ehci_bus_suspend,
- 	.bus_resume		= ehci_bus_resume,
- 
-diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
-index 4378bf7..d2b0957 100644
---- a/drivers/usb/host/ehci-q.c
-+++ b/drivers/usb/host/ehci-q.c
-@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
- 	else {
- 		qtd = list_entry (qh->qtd_list.next,
- 				struct ehci_qtd, qtd_list);
--		/* first qtd may already be partially processed */
--		if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
-+		/*
-+		 * first qtd may already be partially processed.
-+		 * If we come here during unlink, the QH overlay region
-+		 * might have reference to the just unlinked qtd. The
-+		 * qtd is updated in qh_completions(). Update the QH
-+		 * overlay here.
-+		 */
-+		if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
-+			qh->hw->hw_qtd_next = qtd->hw_next;
- 			qtd = NULL;
-+		}
- 	}
- 
- 	if (qtd)
-diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
-index a665b3e..0bf72f9 100644
---- a/drivers/usb/host/ohci-at91.c
-+++ b/drivers/usb/host/ohci-at91.c
-@@ -467,7 +467,8 @@ static irqreturn_t ohci_hcd_at91_overcurrent_irq(int irq, void *data)
- 	/* From the GPIO notifying the over-current situation, find
- 	 * out the corresponding port */
- 	at91_for_each_port(port) {
--		if (gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
-+		if (gpio_is_valid(pdata->overcurrent_pin[port]) &&
-+				gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
- 			gpio = pdata->overcurrent_pin[port];
- 			break;
- 		}
-@@ -570,6 +571,16 @@ static int __devinit ohci_hcd_at91_drv_probe(struct platform_device *pdev)
- 
- 	if (pdata) {
- 		at91_for_each_port(i) {
-+			/*
-+			 * do not configure PIO if not in relation with
-+			 * real USB port on board
-+			 */
-+			if (i >= pdata->ports) {
-+				pdata->vbus_pin[i] = -EINVAL;
-+				pdata->overcurrent_pin[i] = -EINVAL;
-+				break;
-+			}
-+
- 			if (!gpio_is_valid(pdata->vbus_pin[i]))
- 				continue;
- 			gpio = pdata->vbus_pin[i];
-diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
-index c5e9e4a..966d148 100644
---- a/drivers/usb/host/pci-quirks.c
-+++ b/drivers/usb/host/pci-quirks.c
-@@ -75,7 +75,9 @@
- #define	NB_PIF0_PWRDOWN_1	0x01100013
- 
- #define USB_INTEL_XUSB2PR      0xD0
-+#define USB_INTEL_USB2PRM      0xD4
- #define USB_INTEL_USB3_PSSEN   0xD8
-+#define USB_INTEL_USB3PRM      0xDC
- 
- static struct amd_chipset_info {
- 	struct pci_dev	*nb_dev;
-@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
- 		return;
- 	}
- 
--	ports_available = 0xffffffff;
-+	/* Read USB3PRM, the USB 3.0 Port Routing Mask Register
-+	 * Indicate the ports that can be changed from OS.
-+	 */
-+	pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
-+			&ports_available);
-+
-+	dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
-+			ports_available);
-+
- 	/* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
--	 * Register, to turn on SuperSpeed terminations for all
--	 * available ports.
-+	 * Register, to turn on SuperSpeed terminations for the
-+	 * switchable ports.
- 	 */
- 	pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
- 			cpu_to_le32(ports_available));
-@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
- 	dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
- 			"under xHCI: 0x%x\n", ports_available);
- 
--	ports_available = 0xffffffff;
-+	/* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
-+	 * Indicate the USB 2.0 ports to be controlled by the xHCI host.
-+	 */
-+
-+	pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
-+			&ports_available);
-+
-+	dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
-+			ports_available);
-+
- 	/* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
- 	 * switch the USB 2.0 power and data lines over to the xHCI
- 	 * host.
-@@ -822,12 +841,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
- 	void __iomem *op_reg_base;
- 	u32 val;
- 	int timeout;
-+	int len = pci_resource_len(pdev, 0);
- 
- 	if (!mmio_resource_enabled(pdev, 0))
- 		return;
- 
--	base = ioremap_nocache(pci_resource_start(pdev, 0),
--				pci_resource_len(pdev, 0));
-+	base = ioremap_nocache(pci_resource_start(pdev, 0), len);
- 	if (base == NULL)
- 		return;
- 
-@@ -837,9 +856,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
- 	 */
- 	ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
- 	do {
-+		if ((ext_cap_offset + sizeof(val)) > len) {
-+			/* We're reading garbage from the controller */
-+			dev_warn(&pdev->dev,
-+				 "xHCI controller failing to respond");
-+			return;
-+		}
-+
- 		if (!ext_cap_offset)
- 			/* We've reached the end of the extended capabilities */
- 			goto hc_init;
-+
- 		val = readl(base + ext_cap_offset);
- 		if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
- 			break;
-@@ -870,9 +897,10 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
- 	/* Disable any BIOS SMIs and clear all SMI events*/
- 	writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
- 
-+hc_init:
- 	if (usb_is_intel_switchable_xhci(pdev))
- 		usb_enable_xhci_ports(pdev);
--hc_init:
-+
- 	op_reg_base = base + XHCI_HC_LENGTH(readl(base));
- 
- 	/* Wait for the host controller to be ready before writing any
-diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
-index ef004a5..7f69a39 100644
---- a/drivers/usb/host/pci-quirks.h
-+++ b/drivers/usb/host/pci-quirks.h
-@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
- static inline void usb_amd_quirk_pll_disable(void) {}
- static inline void usb_amd_quirk_pll_enable(void) {}
- static inline void usb_amd_dev_put(void) {}
-+static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
- #endif  /* CONFIG_PCI */
- 
- #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
-diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
-index 7b01094..32ca289 100644
---- a/drivers/usb/host/xhci-hub.c
-+++ b/drivers/usb/host/xhci-hub.c
-@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
- 		 * when this bit is set.
- 		 */
- 		pls |= USB_PORT_STAT_CONNECTION;
-+	} else {
-+		/*
-+		 * If CAS bit isn't set but the Port is already at
-+		 * Compliance Mode, fake a connection so the USB core
-+		 * notices the Compliance state and resets the port.
-+		 * This resolves an issue generated by the SN65LVPE502CP
-+		 * in which sometimes the port enters compliance mode
-+		 * caused by a delay on the host-device negotiation.
-+		 */
-+		if (pls == USB_SS_PORT_LS_COMP_MOD)
-+			pls |= USB_PORT_STAT_CONNECTION;
- 	}
-+
- 	/* update status field */
- 	*status |= pls;
- }
- 
-+/*
-+ * Function for Compliance Mode Quirk.
-+ *
-+ * This Function verifies if all xhc USB3 ports have entered U0, if so,
-+ * the compliance mode timer is deleted. A port won't enter
-+ * compliance mode if it has previously entered U0.
-+ */
-+void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
-+{
-+	u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
-+	bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
-+
-+	if (!(xhci->quirks & XHCI_COMP_MODE_QUIRK))
-+		return;
-+
-+	if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) {
-+		xhci->port_status_u0 |= 1 << wIndex;
-+		if (xhci->port_status_u0 == all_ports_seen_u0) {
-+			del_timer_sync(&xhci->comp_mode_recovery_timer);
-+			xhci_dbg(xhci, "All USB3 ports have entered U0 already!\n");
-+			xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted.\n");
-+		}
-+	}
-+}
-+
- int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
- 		u16 wIndex, char *buf, u16 wLength)
- {
-@@ -645,6 +682,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
- 		/* Update Port Link State for super speed ports*/
- 		if (hcd->speed == HCD_USB3) {
- 			xhci_hub_report_link_state(&status, temp);
-+			/*
-+			 * Verify if all USB3 Ports Have entered U0 already.
-+			 * Delete Compliance Mode Timer if so.
-+			 */
-+			xhci_del_comp_mod_timer(xhci, temp, wIndex);
- 		}
- 		if (bus_state->port_c_suspend & (1 << wIndex))
- 			status |= 1 << USB_PORT_FEAT_C_SUSPEND;
-diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
-index 689bc18..df90fe5 100644
---- a/drivers/usb/host/xhci-plat.c
-+++ b/drivers/usb/host/xhci-plat.c
-@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
- 		goto put_hcd;
- 	}
- 
--	hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
-+	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
- 	if (!hcd->regs) {
- 		dev_dbg(&pdev->dev, "error mapping memory\n");
- 		ret = -EFAULT;
-diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index 81aa10c..45f0b65 100644
---- a/drivers/usb/host/xhci.c
-+++ b/drivers/usb/host/xhci.c
-@@ -26,6 +26,7 @@
- #include <linux/module.h>
- #include <linux/moduleparam.h>
- #include <linux/slab.h>
-+#include <linux/dmi.h>
- 
- #include "xhci.h"
- 
-@@ -398,6 +399,95 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
- 
- #endif
- 
-+static void compliance_mode_recovery(unsigned long arg)
-+{
-+	struct xhci_hcd *xhci;
-+	struct usb_hcd *hcd;
-+	u32 temp;
-+	int i;
-+
-+	xhci = (struct xhci_hcd *)arg;
-+
-+	for (i = 0; i < xhci->num_usb3_ports; i++) {
-+		temp = xhci_readl(xhci, xhci->usb3_ports[i]);
-+		if ((temp & PORT_PLS_MASK) == USB_SS_PORT_LS_COMP_MOD) {
-+			/*
-+			 * Compliance Mode Detected. Letting USB Core
-+			 * handle the Warm Reset
-+			 */
-+			xhci_dbg(xhci, "Compliance Mode Detected->Port %d!\n",
-+					i + 1);
-+			xhci_dbg(xhci, "Attempting Recovery routine!\n");
-+			hcd = xhci->shared_hcd;
-+
-+			if (hcd->state == HC_STATE_SUSPENDED)
-+				usb_hcd_resume_root_hub(hcd);
-+
-+			usb_hcd_poll_rh_status(hcd);
-+		}
-+	}
-+
-+	if (xhci->port_status_u0 != ((1 << xhci->num_usb3_ports)-1))
-+		mod_timer(&xhci->comp_mode_recovery_timer,
-+			jiffies + msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
-+}
-+
-+/*
-+ * Quirk to work around issue generated by the SN65LVPE502CP USB3.0 re-driver
-+ * that causes ports behind that hardware to enter compliance mode sometimes.
-+ * The quirk creates a timer that polls every 2 seconds the link state of
-+ * each host controller's port and recovers it by issuing a Warm reset
-+ * if Compliance mode is detected, otherwise the port will become "dead" (no
-+ * device connections or disconnections will be detected anymore). Becasue no
-+ * status event is generated when entering compliance mode (per xhci spec),
-+ * this quirk is needed on systems that have the failing hardware installed.
-+ */
-+static void compliance_mode_recovery_timer_init(struct xhci_hcd *xhci)
-+{
-+	xhci->port_status_u0 = 0;
-+	init_timer(&xhci->comp_mode_recovery_timer);
-+
-+	xhci->comp_mode_recovery_timer.data = (unsigned long) xhci;
-+	xhci->comp_mode_recovery_timer.function = compliance_mode_recovery;
-+	xhci->comp_mode_recovery_timer.expires = jiffies +
-+			msecs_to_jiffies(COMP_MODE_RCVRY_MSECS);
-+
-+	set_timer_slack(&xhci->comp_mode_recovery_timer,
-+			msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
-+	add_timer(&xhci->comp_mode_recovery_timer);
-+	xhci_dbg(xhci, "Compliance Mode Recovery Timer Initialized.\n");
-+}
-+
-+/*
-+ * This function identifies the systems that have installed the SN65LVPE502CP
-+ * USB3.0 re-driver and that need the Compliance Mode Quirk.
-+ * Systems:
-+ * Vendor: Hewlett-Packard -> System Models: Z420, Z620 and Z820
-+ */
-+static bool compliance_mode_recovery_timer_quirk_check(void)
-+{
-+	const char *dmi_product_name, *dmi_sys_vendor;
-+
-+	dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
-+	dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
-+
-+	if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
-+		return false;
-+
-+	if (strstr(dmi_product_name, "Z420") ||
-+			strstr(dmi_product_name, "Z620") ||
-+			strstr(dmi_product_name, "Z820"))
-+		return true;
-+
-+	return false;
-+}
-+
-+static int xhci_all_ports_seen_u0(struct xhci_hcd *xhci)
-+{
-+	return (xhci->port_status_u0 == ((1 << xhci->num_usb3_ports)-1));
-+}
-+
-+
- /*
-  * Initialize memory for HCD and xHC (one-time init).
-  *
-@@ -421,6 +511,12 @@ int xhci_init(struct usb_hcd *hcd)
- 	retval = xhci_mem_init(xhci, GFP_KERNEL);
- 	xhci_dbg(xhci, "Finished xhci_init\n");
- 
-+	/* Initializing Compliance Mode Recovery Data If Needed */
-+	if (compliance_mode_recovery_timer_quirk_check()) {
-+		xhci->quirks |= XHCI_COMP_MODE_QUIRK;
-+		compliance_mode_recovery_timer_init(xhci);
-+	}
-+
- 	return retval;
- }
- 
-@@ -629,6 +725,11 @@ void xhci_stop(struct usb_hcd *hcd)
- 	del_timer_sync(&xhci->event_ring_timer);
- #endif
- 
-+	/* Deleting Compliance Mode Recovery Timer */
-+	if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
-+			(!(xhci_all_ports_seen_u0(xhci))))
-+		del_timer_sync(&xhci->comp_mode_recovery_timer);
-+
- 	if (xhci->quirks & XHCI_AMD_PLL_FIX)
- 		usb_amd_dev_put();
- 
-@@ -659,7 +760,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
- {
- 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
- 
--	if (xhci->quirks && XHCI_SPURIOUS_REBOOT)
-+	if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
- 		usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
- 
- 	spin_lock_irq(&xhci->lock);
-@@ -806,6 +907,16 @@ int xhci_suspend(struct xhci_hcd *xhci)
- 	}
- 	spin_unlock_irq(&xhci->lock);
- 
-+	/*
-+	 * Deleting Compliance Mode Recovery Timer because the xHCI Host
-+	 * is about to be suspended.
-+	 */
-+	if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
-+			(!(xhci_all_ports_seen_u0(xhci)))) {
-+		del_timer_sync(&xhci->comp_mode_recovery_timer);
-+		xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted!\n");
-+	}
-+
- 	/* step 5: remove core well power */
- 	/* synchronize irq when using MSI-X */
- 	xhci_msix_sync_irqs(xhci);
-@@ -938,6 +1049,16 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
- 		usb_hcd_resume_root_hub(hcd);
- 		usb_hcd_resume_root_hub(xhci->shared_hcd);
- 	}
-+
-+	/*
-+	 * If system is subject to the Quirk, Compliance Mode Timer needs to
-+	 * be re-initialized Always after a system resume. Ports are subject
-+	 * to suffer the Compliance Mode issue again. It doesn't matter if
-+	 * ports have entered previously to U0 before system's suspension.
-+	 */
-+	if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
-+		compliance_mode_recovery_timer_init(xhci);
-+
- 	return retval;
- }
- #endif	/* CONFIG_PM */
-diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
-index 27497d3..a7760bf 100644
---- a/drivers/usb/host/xhci.h
-+++ b/drivers/usb/host/xhci.h
-@@ -1495,6 +1495,7 @@ struct xhci_hcd {
- #define XHCI_LPM_SUPPORT	(1 << 11)
- #define XHCI_INTEL_HOST		(1 << 12)
- #define XHCI_SPURIOUS_REBOOT	(1 << 13)
-+#define XHCI_COMP_MODE_QUIRK	(1 << 14)
- 	unsigned int		num_active_eps;
- 	unsigned int		limit_active_eps;
- 	/* There are two roothubs to keep track of bus suspend info for */
-@@ -1511,6 +1512,11 @@ struct xhci_hcd {
- 	unsigned		sw_lpm_support:1;
- 	/* support xHCI 1.0 spec USB2 hardware LPM */
- 	unsigned		hw_lpm_support:1;
-+	/* Compliance Mode Recovery Data */
-+	struct timer_list	comp_mode_recovery_timer;
-+	u32			port_status_u0;
-+/* Compliance Mode Timer Triggered every 2 seconds */
-+#define COMP_MODE_RCVRY_MSECS 2000
- };
- 
- /* convert between an HCD pointer and the corresponding EHCI_HCD */
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 5620db6..f906b3a 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -704,6 +704,7 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
- 	{ USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
- 	{ USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
- 	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
-@@ -804,13 +805,32 @@ static struct usb_device_id id_table_combined [] = {
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--	{ USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
-+					USB_CLASS_VENDOR_SPEC,
-+					USB_SUBCLASS_VENDOR_SPEC, 0x00) },
- 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
- 	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
- 	{ USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
-+	{ USB_DEVICE(FTDI_VID, PI_C865_PID) },
-+	{ USB_DEVICE(FTDI_VID, PI_C857_PID) },
-+	{ USB_DEVICE(PI_VID, PI_C866_PID) },
-+	{ USB_DEVICE(PI_VID, PI_C663_PID) },
-+	{ USB_DEVICE(PI_VID, PI_C725_PID) },
-+	{ USB_DEVICE(PI_VID, PI_E517_PID) },
-+	{ USB_DEVICE(PI_VID, PI_C863_PID) },
- 	{ USB_DEVICE(PI_VID, PI_E861_PID) },
-+	{ USB_DEVICE(PI_VID, PI_C867_PID) },
-+	{ USB_DEVICE(PI_VID, PI_E609_PID) },
-+	{ USB_DEVICE(PI_VID, PI_E709_PID) },
-+	{ USB_DEVICE(PI_VID, PI_100F_PID) },
-+	{ USB_DEVICE(PI_VID, PI_1011_PID) },
-+	{ USB_DEVICE(PI_VID, PI_1012_PID) },
-+	{ USB_DEVICE(PI_VID, PI_1013_PID) },
-+	{ USB_DEVICE(PI_VID, PI_1014_PID) },
-+	{ USB_DEVICE(PI_VID, PI_1015_PID) },
-+	{ USB_DEVICE(PI_VID, PI_1016_PID) },
- 	{ USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
- 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
- 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index 5dd96ca..41fe582 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -75,6 +75,9 @@
- #define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
- #define FTDI_OPENDCC_GBM_PID	0xBFDC
- 
-+/* NZR SEM 16+ USB (http://www.nzr.de) */
-+#define FTDI_NZR_SEM_USB_PID	0xC1E0	/* NZR SEM-LOG16+ */
-+
- /*
-  * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
-  */
-@@ -539,7 +542,10 @@
- /*
-  * Microchip Technology, Inc.
-  *
-- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
-+ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
-+ * used by single function CDC ACM class based firmware demo
-+ * applications.  The VID/PID has also been used in firmware
-+ * emulating FTDI serial chips by:
-  * Hornby Elite - Digital Command Control Console
-  * http://www.hornby.com/hornby-dcc/controllers/
-  */
-@@ -791,8 +797,27 @@
-  * Physik Instrumente
-  * http://www.physikinstrumente.com/en/products/
-  */
-+/* These two devices use the VID of FTDI */
-+#define PI_C865_PID	0xe0a0  /* PI C-865 Piezomotor Controller */
-+#define PI_C857_PID	0xe0a1  /* PI Encoder Trigger Box */
-+
- #define PI_VID              0x1a72  /* Vendor ID */
--#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
-+#define PI_C866_PID	0x1000  /* PI C-866 Piezomotor Controller */
-+#define PI_C663_PID	0x1001  /* PI C-663 Mercury-Step */
-+#define PI_C725_PID	0x1002  /* PI C-725 Piezomotor Controller */
-+#define PI_E517_PID	0x1005  /* PI E-517 Digital Piezo Controller Operation Module */
-+#define PI_C863_PID	0x1007  /* PI C-863 */
-+#define PI_E861_PID	0x1008  /* PI E-861 Piezomotor Controller */
-+#define PI_C867_PID	0x1009  /* PI C-867 Piezomotor Controller */
-+#define PI_E609_PID	0x100D  /* PI E-609 Digital Piezo Controller */
-+#define PI_E709_PID	0x100E  /* PI E-709 Digital Piezo Controller */
-+#define PI_100F_PID	0x100F  /* PI Digital Piezo Controller */
-+#define PI_1011_PID	0x1011  /* PI Digital Piezo Controller */
-+#define PI_1012_PID	0x1012  /* PI Motion Controller */
-+#define PI_1013_PID	0x1013  /* PI Motion Controller */
-+#define PI_1014_PID	0x1014  /* PI Device */
-+#define PI_1015_PID	0x1015  /* PI Device */
-+#define PI_1016_PID	0x1016  /* PI Digital Servo Module */
- 
- /*
-  * Kondo Kagaku Co.Ltd.
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index d2c2698..61ab0ed 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -886,8 +886,6 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
- 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
--	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
--	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
-@@ -1092,6 +1090,10 @@ static const struct usb_device_id option_ids[] = {
- 	 .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
- 	 .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
-+	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
-+	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
-+	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
-+
- 	{ USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
- 	{ USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
- 	{ USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
-diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 2e471c2..88e9204 100644
---- a/drivers/video/console/fbcon.c
-+++ b/drivers/video/console/fbcon.c
-@@ -372,8 +372,15 @@ static void fb_flashcursor(struct work_struct *work)
- 	struct vc_data *vc = NULL;
- 	int c;
- 	int mode;
-+	int ret;
-+
-+	/* FIXME: we should sort out the unbind locking instead */
-+	/* instead we just fail to flash the cursor if we can't get
-+	 * the lock instead of blocking fbcon deinit */
-+	ret = console_trylock();
-+	if (ret == 0)
-+		return;
- 
--	console_lock();
- 	if (ops && ops->currcon != -1)
- 		vc = vc_cons[ops->currcon].d;
- 
-diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
-index 1eff743..ae60406 100644
---- a/drivers/watchdog/hpwdt.c
-+++ b/drivers/watchdog/hpwdt.c
-@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev,
- 	hpwdt_timer_reg = pci_mem_addr + 0x70;
- 	hpwdt_timer_con = pci_mem_addr + 0x72;
- 
-+	/* Make sure that timer is disabled until /dev/watchdog is opened */
-+	hpwdt_stop();
-+
- 	/* Make sure that we have a valid soft_margin */
- 	if (hpwdt_change_timer(soft_margin))
- 		hpwdt_change_timer(DEFAULT_MARGIN);
-diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
-index 1ffd03b..7f12416 100644
---- a/drivers/xen/gntdev.c
-+++ b/drivers/xen/gntdev.c
-@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct grant_map *map, int offset, int pages)
- 		}
- 	}
- 
--	err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset,
--				pages, true);
-+	err = gnttab_unmap_refs(map->unmap_ops + offset,
-+			use_ptemod ? map->kmap_ops + offset : NULL, map->pages + offset,
-+			pages);
- 	if (err)
- 		return err;
- 
-diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
-index 0bfc1ef..0067266 100644
---- a/drivers/xen/grant-table.c
-+++ b/drivers/xen/grant-table.c
-@@ -870,7 +870,8 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
- EXPORT_SYMBOL_GPL(gnttab_map_refs);
- 
- int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
--		      struct page **pages, unsigned int count, bool clear_pte)
-+		      struct gnttab_map_grant_ref *kmap_ops,
-+		      struct page **pages, unsigned int count)
- {
- 	int i, ret;
- 	bool lazy = false;
-@@ -888,7 +889,8 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
- 	}
- 
- 	for (i = 0; i < count; i++) {
--		ret = m2p_remove_override(pages[i], clear_pte);
-+		ret = m2p_remove_override(pages[i], kmap_ops ?
-+				       &kmap_ops[i] : NULL);
- 		if (ret)
- 			return ret;
- 	}
-diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
-index fbb9da9..33ef60d 100644
---- a/fs/cifs/cifs_unicode.c
-+++ b/fs/cifs/cifs_unicode.c
-@@ -328,6 +328,6 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
- 	}
- 
- ctoUTF16_out:
--	return i;
-+	return j;
- }
- 
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 4046904..4123b92 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
- 	 * Inform try_to_ascend() that we are no longer attached to the
- 	 * dentry tree
- 	 */
--	dentry->d_flags |= DCACHE_DISCONNECTED;
-+	dentry->d_flags |= DCACHE_DENTRY_KILLED;
- 	if (parent)
- 		spin_unlock(&parent->d_lock);
- 	dentry_iput(dentry);
-@@ -1046,7 +1046,7 @@ static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq
- 	 * or deletion
- 	 */
- 	if (new != old->d_parent ||
--		 (old->d_flags & DCACHE_DISCONNECTED) ||
-+		 (old->d_flags & DCACHE_DENTRY_KILLED) ||
- 		 (!locked && read_seqretry(&rename_lock, seq))) {
- 		spin_unlock(&new->d_lock);
- 		new = NULL;
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index a07441a..02e2fec 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -621,6 +621,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- 	struct dentry *lower_old_dir_dentry;
- 	struct dentry *lower_new_dir_dentry;
- 	struct dentry *trap = NULL;
-+	struct inode *target_inode;
- 
- 	lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
- 	lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
-@@ -628,6 +629,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- 	dget(lower_new_dentry);
- 	lower_old_dir_dentry = dget_parent(lower_old_dentry);
- 	lower_new_dir_dentry = dget_parent(lower_new_dentry);
-+	target_inode = new_dentry->d_inode;
- 	trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
- 	/* source should not be ancestor of target */
- 	if (trap == lower_old_dentry) {
-@@ -643,6 +645,9 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
- 			lower_new_dir_dentry->d_inode, lower_new_dentry);
- 	if (rc)
- 		goto out_lock;
-+	if (target_inode)
-+		fsstack_copy_attr_all(target_inode,
-+				      ecryptfs_inode_to_lower(target_inode));
- 	fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
- 	if (new_dir != old_dir)
- 		fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index f430057..b1f3675 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -1123,7 +1123,7 @@ static int nfs_lookup_revalidate(struct dentry *dentry, struct nameidata *nd)
- 	struct nfs_fattr *fattr = NULL;
- 	int error;
- 
--	if (nd->flags & LOOKUP_RCU)
-+	if (nd && (nd->flags & LOOKUP_RCU))
- 		return -ECHILD;
- 
- 	parent = dget_parent(dentry);
-@@ -1526,7 +1526,7 @@ static int nfs4_lookup_revalidate(struct dentry *dentry, struct nameidata *nd)
- 	struct inode *dir;
- 	int openflags, ret = 0;
- 
--	if (nd->flags & LOOKUP_RCU)
-+	if (nd && (nd->flags & LOOKUP_RCU))
- 		return -ECHILD;
- 
- 	inode = dentry->d_inode;
-diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index f729698..30bd45a 100644
---- a/fs/nfs/inode.c
-+++ b/fs/nfs/inode.c
-@@ -152,7 +152,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
- 	nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
- 	nfsi->attrtimeo_timestamp = jiffies;
- 
--	memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
-+	memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
- 	if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
- 		nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
- 	else
-diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
-index af051d8..fda63e9 100644
---- a/fs/nfs/nfs3proc.c
-+++ b/fs/nfs/nfs3proc.c
-@@ -643,7 +643,7 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
- 		  u64 cookie, struct page **pages, unsigned int count, int plus)
- {
- 	struct inode		*dir = dentry->d_inode;
--	__be32			*verf = NFS_COOKIEVERF(dir);
-+	__be32			*verf = NFS_I(dir)->cookieverf;
- 	struct nfs3_readdirargs	arg = {
- 		.fh		= NFS_FH(dir),
- 		.cookie		= cookie,
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index b3bca1e..dd372e2 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -3189,11 +3189,11 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
- 			dentry->d_parent->d_name.name,
- 			dentry->d_name.name,
- 			(unsigned long long)cookie);
--	nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
-+	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
- 	res.pgbase = args.pgbase;
- 	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
- 	if (status >= 0) {
--		memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
-+		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
- 		status += args.pgbase;
- 	}
- 
-diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
-index 18fae29..cfce99b 100644
---- a/fs/nfs/nfs4xdr.c
-+++ b/fs/nfs/nfs4xdr.c
-@@ -6262,7 +6262,8 @@ static int nfs4_xdr_dec_open(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
- 	status = decode_open(xdr, res);
- 	if (status)
- 		goto out;
--	if (decode_getfh(xdr, &res->fh) != 0)
-+	status = decode_getfh(xdr, &res->fh);
-+	if (status)
- 		goto out;
- 	decode_getfattr(xdr, res->f_attr, res->server);
- out:
-diff --git a/fs/nfs/super.c b/fs/nfs/super.c
-index 1d4b23e..cdbaae2 100644
---- a/fs/nfs/super.c
-+++ b/fs/nfs/super.c
-@@ -1918,6 +1918,7 @@ static int nfs23_validate_mount_data(void *options,
- 
- 		memcpy(sap, &data->addr, sizeof(data->addr));
- 		args->nfs_server.addrlen = sizeof(data->addr);
-+		args->nfs_server.port = ntohs(data->addr.sin_port);
- 		if (!nfs_verify_server_address(sap))
- 			goto out_no_address;
- 
-@@ -2651,6 +2652,7 @@ static int nfs4_validate_mount_data(void *options,
- 			return -EFAULT;
- 		if (!nfs_verify_server_address(sap))
- 			goto out_no_address;
-+		args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
- 
- 		if (data->auth_flavourlen) {
- 			if (data->auth_flavourlen > 1)
-diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
-index c55298e..fa49cff 100644
---- a/fs/nfsd/nfsctl.c
-+++ b/fs/nfsd/nfsctl.c
-@@ -673,9 +673,7 @@ static ssize_t __write_ports_addfd(char *buf)
- 
- 	err = svc_addsock(nfsd_serv, fd, buf, SIMPLE_TRANSACTION_LIMIT);
- 	if (err < 0) {
--		if (nfsd_serv->sv_nrthreads == 1)
--			svc_shutdown_net(nfsd_serv, net);
--		svc_destroy(nfsd_serv);
-+		nfsd_destroy(net);
- 		return err;
- 	}
- 
-@@ -744,9 +742,7 @@ out_close:
- 		svc_xprt_put(xprt);
- 	}
- out_err:
--	if (nfsd_serv->sv_nrthreads == 1)
--		svc_shutdown_net(nfsd_serv, net);
--	svc_destroy(nfsd_serv);
-+	nfsd_destroy(net);
- 	return err;
- }
- 
-diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
-index 1671429..1336a65 100644
---- a/fs/nfsd/nfsd.h
-+++ b/fs/nfsd/nfsd.h
-@@ -73,6 +73,17 @@ int		nfsd_nrpools(void);
- int		nfsd_get_nrthreads(int n, int *);
- int		nfsd_set_nrthreads(int n, int *);
- 
-+static inline void nfsd_destroy(struct net *net)
-+{
-+	int destroy = (nfsd_serv->sv_nrthreads == 1);
-+
-+	if (destroy)
-+		svc_shutdown_net(nfsd_serv, net);
-+	svc_destroy(nfsd_serv);
-+	if (destroy)
-+		nfsd_serv = NULL;
-+}
-+
- #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
- #ifdef CONFIG_NFSD_V2_ACL
- extern struct svc_version nfsd_acl_version2;
-diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
-index ee709fc..240473c 100644
---- a/fs/nfsd/nfssvc.c
-+++ b/fs/nfsd/nfssvc.c
-@@ -254,8 +254,6 @@ static void nfsd_shutdown(void)
- 
- static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
- {
--	/* When last nfsd thread exits we need to do some clean-up */
--	nfsd_serv = NULL;
- 	nfsd_shutdown();
- 
- 	svc_rpcb_cleanup(serv, net);
-@@ -332,6 +330,7 @@ static int nfsd_get_default_max_blksize(void)
- int nfsd_create_serv(void)
- {
- 	int error;
-+	struct net *net = current->nsproxy->net_ns;
- 
- 	WARN_ON(!mutex_is_locked(&nfsd_mutex));
- 	if (nfsd_serv) {
-@@ -346,7 +345,7 @@ int nfsd_create_serv(void)
- 	if (nfsd_serv == NULL)
- 		return -ENOMEM;
- 
--	error = svc_bind(nfsd_serv, current->nsproxy->net_ns);
-+	error = svc_bind(nfsd_serv, net);
- 	if (error < 0) {
- 		svc_destroy(nfsd_serv);
- 		return error;
-@@ -427,11 +426,7 @@ int nfsd_set_nrthreads(int n, int *nthreads)
- 		if (err)
- 			break;
- 	}
--
--	if (nfsd_serv->sv_nrthreads == 1)
--		svc_shutdown_net(nfsd_serv, net);
--	svc_destroy(nfsd_serv);
--
-+	nfsd_destroy(net);
- 	return err;
- }
- 
-@@ -478,9 +473,7 @@ out_shutdown:
- 	if (error < 0 && !nfsd_up_before)
- 		nfsd_shutdown();
- out_destroy:
--	if (nfsd_serv->sv_nrthreads == 1)
--		svc_shutdown_net(nfsd_serv, net);
--	svc_destroy(nfsd_serv);		/* Release server */
-+	nfsd_destroy(net);		/* Release server */
- out:
- 	mutex_unlock(&nfsd_mutex);
- 	return error;
-@@ -563,12 +556,13 @@ nfsd(void *vrqstp)
- 	nfsdstats.th_cnt --;
- 
- out:
--	if (rqstp->rq_server->sv_nrthreads == 1)
--		svc_shutdown_net(rqstp->rq_server, &init_net);
-+	rqstp->rq_server = NULL;
- 
- 	/* Release the thread */
- 	svc_exit_thread(rqstp);
- 
-+	nfsd_destroy(&init_net);
-+
- 	/* Release module */
- 	mutex_unlock(&nfsd_mutex);
- 	module_put_and_exit(0);
-@@ -682,9 +676,7 @@ int nfsd_pool_stats_release(struct inode *inode, struct file *file)
- 
- 	mutex_lock(&nfsd_mutex);
- 	/* this function really, really should have been called svc_put() */
--	if (nfsd_serv->sv_nrthreads == 1)
--		svc_shutdown_net(nfsd_serv, net);
--	svc_destroy(nfsd_serv);
-+	nfsd_destroy(net);
- 	mutex_unlock(&nfsd_mutex);
- 	return ret;
- }
-diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
-index 3476bca..5d00eb8 100644
---- a/fs/proc/proc_sysctl.c
-+++ b/fs/proc/proc_sysctl.c
-@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
- 
- 	err = ERR_PTR(-ENOMEM);
- 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
--	if (h)
--		sysctl_head_finish(h);
--
- 	if (!inode)
- 		goto out;
- 
-@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
- 	d_add(dentry, inode);
- 
- out:
-+	if (h)
-+		sysctl_head_finish(h);
- 	sysctl_head_finish(head);
- 	return err;
- }
-diff --git a/fs/stat.c b/fs/stat.c
-index b6ff118..4078022 100644
---- a/fs/stat.c
-+++ b/fs/stat.c
-@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr);
- int vfs_fstat(unsigned int fd, struct kstat *stat)
- {
- 	int fput_needed;
--	struct file *f = fget_light(fd, &fput_needed);
-+	struct file *f = fget_raw_light(fd, &fput_needed);
- 	int error = -EBADF;
- 
- 	if (f) {
-diff --git a/include/asm-generic/mutex-xchg.h b/include/asm-generic/mutex-xchg.h
-index 580a6d3..c04e0db 100644
---- a/include/asm-generic/mutex-xchg.h
-+++ b/include/asm-generic/mutex-xchg.h
-@@ -26,7 +26,13 @@ static inline void
- __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
- {
- 	if (unlikely(atomic_xchg(count, 0) != 1))
--		fail_fn(count);
-+		/*
-+		 * We failed to acquire the lock, so mark it contended
-+		 * to ensure that any waiting tasks are woken up by the
-+		 * unlock slow path.
-+		 */
-+		if (likely(atomic_xchg(count, -1) != 1))
-+			fail_fn(count);
- }
- 
- /**
-@@ -43,7 +49,8 @@ static inline int
- __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
- {
- 	if (unlikely(atomic_xchg(count, 0) != 1))
--		return fail_fn(count);
-+		if (likely(atomic_xchg(count, -1) != 1))
-+			return fail_fn(count);
- 	return 0;
- }
- 
-diff --git a/include/drm/drm_mode.h b/include/drm/drm_mode.h
-index 5581980..3d6301b 100644
---- a/include/drm/drm_mode.h
-+++ b/include/drm/drm_mode.h
-@@ -359,8 +359,9 @@ struct drm_mode_mode_cmd {
- 	struct drm_mode_modeinfo mode;
- };
- 
--#define DRM_MODE_CURSOR_BO	(1<<0)
--#define DRM_MODE_CURSOR_MOVE	(1<<1)
-+#define DRM_MODE_CURSOR_BO	0x01
-+#define DRM_MODE_CURSOR_MOVE	0x02
-+#define DRM_MODE_CURSOR_FLAGS	0x03
- 
- /*
-  * depending on the value in flags different members are used.
-diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index 094789f..525ab12 100644
---- a/include/linux/dcache.h
-+++ b/include/linux/dcache.h
-@@ -206,6 +206,8 @@ struct dentry_operations {
- #define DCACHE_MANAGED_DENTRY \
- 	(DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
- 
-+#define DCACHE_DENTRY_KILLED	0x100000
-+
- extern seqlock_t rename_lock;
- 
- static inline int dname_external(struct dentry *dentry)
-diff --git a/include/linux/init_task.h b/include/linux/init_task.h
-index 9e65eff..b806b82 100644
---- a/include/linux/init_task.h
-+++ b/include/linux/init_task.h
-@@ -123,8 +123,17 @@ extern struct group_info init_groups;
- 
- extern struct cred init_cred;
- 
-+extern struct task_group root_task_group;
-+
-+#ifdef CONFIG_CGROUP_SCHED
-+# define INIT_CGROUP_SCHED(tsk)						\
-+	.sched_task_group = &root_task_group,
-+#else
-+# define INIT_CGROUP_SCHED(tsk)
-+#endif
-+
- #ifdef CONFIG_PERF_EVENTS
--# define INIT_PERF_EVENTS(tsk)					\
-+# define INIT_PERF_EVENTS(tsk)						\
- 	.perf_event_mutex = 						\
- 		 __MUTEX_INITIALIZER(tsk.perf_event_mutex),		\
- 	.perf_event_list = LIST_HEAD_INIT(tsk.perf_event_list),
-@@ -161,6 +170,7 @@ extern struct cred init_cred;
- 	},								\
- 	.tasks		= LIST_HEAD_INIT(tsk.tasks),			\
- 	INIT_PUSHABLE_TASKS(tsk)					\
-+	INIT_CGROUP_SCHED(tsk)						\
- 	.ptraced	= LIST_HEAD_INIT(tsk.ptraced),			\
- 	.ptrace_entry	= LIST_HEAD_INIT(tsk.ptrace_entry),		\
- 	.real_parent	= &tsk,						\
-diff --git a/include/linux/kobject.h b/include/linux/kobject.h
-index fc615a9..1e57449 100644
---- a/include/linux/kobject.h
-+++ b/include/linux/kobject.h
-@@ -224,7 +224,7 @@ static inline int kobject_uevent_env(struct kobject *kobj,
- 
- static inline __printf(2, 3)
- int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...)
--{ return 0; }
-+{ return -ENOMEM; }
- 
- static inline int kobject_action_type(const char *buf, size_t count,
- 				      enum kobject_action *type)
-diff --git a/include/linux/kthread.h b/include/linux/kthread.h
-index 0714b24..22ccf9d 100644
---- a/include/linux/kthread.h
-+++ b/include/linux/kthread.h
-@@ -49,8 +49,6 @@ extern int tsk_fork_get_node(struct task_struct *tsk);
-  * can be queued and flushed using queue/flush_kthread_work()
-  * respectively.  Queued kthread_works are processed by a kthread
-  * running kthread_worker_fn().
-- *
-- * A kthread_work can't be freed while it is executing.
-  */
- struct kthread_work;
- typedef void (*kthread_work_func_t)(struct kthread_work *work);
-@@ -59,15 +57,14 @@ struct kthread_worker {
- 	spinlock_t		lock;
- 	struct list_head	work_list;
- 	struct task_struct	*task;
-+	struct kthread_work	*current_work;
- };
- 
- struct kthread_work {
- 	struct list_head	node;
- 	kthread_work_func_t	func;
- 	wait_queue_head_t	done;
--	atomic_t		flushing;
--	int			queue_seq;
--	int			done_seq;
-+	struct kthread_worker	*worker;
- };
- 
- #define KTHREAD_WORKER_INIT(worker)	{				\
-@@ -79,7 +76,6 @@ struct kthread_work {
- 	.node = LIST_HEAD_INIT((work).node),				\
- 	.func = (fn),							\
- 	.done = __WAIT_QUEUE_HEAD_INITIALIZER((work).done),		\
--	.flushing = ATOMIC_INIT(0),					\
- 	}
- 
- #define DEFINE_KTHREAD_WORKER(worker)					\
-diff --git a/include/linux/ktime.h b/include/linux/ktime.h
-index 603bec2..06177ba10 100644
---- a/include/linux/ktime.h
-+++ b/include/linux/ktime.h
-@@ -58,13 +58,6 @@ union ktime {
- 
- typedef union ktime ktime_t;		/* Kill this */
- 
--#define KTIME_MAX			((s64)~((u64)1 << 63))
--#if (BITS_PER_LONG == 64)
--# define KTIME_SEC_MAX			(KTIME_MAX / NSEC_PER_SEC)
--#else
--# define KTIME_SEC_MAX			LONG_MAX
--#endif
--
- /*
-  * ktime_t definitions when using the 64-bit scalar representation:
-  */
-diff --git a/include/linux/mISDNhw.h b/include/linux/mISDNhw.h
-index d0752ec..9d96d5d 100644
---- a/include/linux/mISDNhw.h
-+++ b/include/linux/mISDNhw.h
-@@ -183,7 +183,7 @@ extern int	mISDN_initbchannel(struct bchannel *, unsigned short,
- 				   unsigned short);
- extern int	mISDN_freedchannel(struct dchannel *);
- extern void	mISDN_clear_bchannel(struct bchannel *);
--extern int	mISDN_freebchannel(struct bchannel *);
-+extern void	mISDN_freebchannel(struct bchannel *);
- extern int	mISDN_ctrl_bchannel(struct bchannel *, struct mISDN_ctrl_req *);
- extern void	queue_ch_frame(struct mISDNchannel *, u_int,
- 			int, struct sk_buff *);
-diff --git a/include/linux/memory.h b/include/linux/memory.h
-index 1ac7f6e..ff9a9f8 100644
---- a/include/linux/memory.h
-+++ b/include/linux/memory.h
-@@ -19,7 +19,7 @@
- #include <linux/compiler.h>
- #include <linux/mutex.h>
- 
--#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
-+#define MIN_MEMORY_BLOCK_SIZE     (1UL << SECTION_SIZE_BITS)
- 
- struct memory_block {
- 	unsigned long start_section_nr;
-diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
-index d76513b..2bd1769 100644
---- a/include/linux/mmc/card.h
-+++ b/include/linux/mmc/card.h
-@@ -238,6 +238,7 @@ struct mmc_card {
- #define MMC_QUIRK_BLK_NO_CMD23	(1<<7)		/* Avoid CMD23 for regular multiblock */
- #define MMC_QUIRK_BROKEN_BYTE_MODE_512 (1<<8)	/* Avoid sending 512 bytes in */
- #define MMC_QUIRK_LONG_READ_TIME (1<<9)		/* Data read time > CSD says */
-+#define MMC_QUIRK_SEC_ERASE_TRIM_BROKEN (1<<10)	/* Skip secure for erase/trim */
- 						/* byte mode */
- 	unsigned int    poweroff_notify_state;	/* eMMC4.5 notify feature */
- #define MMC_NO_POWER_NOTIFICATION	0
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index d94cb14..b52070a 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -1301,6 +1301,8 @@ struct net_device {
- 	/* for setting kernel sock attribute on TCP connection setup */
- #define GSO_MAX_SIZE		65536
- 	unsigned int		gso_max_size;
-+#define GSO_MAX_SEGS		65535
-+	u16			gso_max_segs;
- 
- #ifdef CONFIG_DCB
- 	/* Data Center Bridging netlink ops */
-@@ -1518,6 +1520,8 @@ struct packet_type {
- 	struct sk_buff		**(*gro_receive)(struct sk_buff **head,
- 					       struct sk_buff *skb);
- 	int			(*gro_complete)(struct sk_buff *skb);
-+	bool			(*id_match)(struct packet_type *ptype,
-+					    struct sock *sk);
- 	void			*af_packet_priv;
- 	struct list_head	list;
- };
-diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
-index b23cfc1..4841108 100644
---- a/include/linux/nfs_fs.h
-+++ b/include/linux/nfs_fs.h
-@@ -265,11 +265,6 @@ static inline const struct nfs_rpc_ops *NFS_PROTO(const struct inode *inode)
- 	return NFS_SERVER(inode)->nfs_client->rpc_ops;
- }
- 
--static inline __be32 *NFS_COOKIEVERF(const struct inode *inode)
--{
--	return NFS_I(inode)->cookieverf;
--}
--
- static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode)
- {
- 	struct nfs_server *nfss = NFS_SERVER(inode);
-diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
-index ab741b0..c642b81 100644
---- a/include/linux/pci_ids.h
-+++ b/include/linux/pci_ids.h
-@@ -2148,7 +2148,7 @@
- #define PCI_DEVICE_ID_TIGON3_5704S	0x16a8
- #define PCI_DEVICE_ID_NX2_57800_VF	0x16a9
- #define PCI_DEVICE_ID_NX2_5706S		0x16aa
--#define PCI_DEVICE_ID_NX2_57840_MF	0x16ab
-+#define PCI_DEVICE_ID_NX2_57840_MF	0x16a4
- #define PCI_DEVICE_ID_NX2_5708S		0x16ac
- #define PCI_DEVICE_ID_NX2_57840_VF	0x16ad
- #define PCI_DEVICE_ID_NX2_57810_MF	0x16ae
-diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
-index 45db49f..c3c98a6 100644
---- a/include/linux/perf_event.h
-+++ b/include/linux/perf_event.h
-@@ -274,6 +274,8 @@ struct perf_event_attr {
- 	__u64	branch_sample_type; /* enum branch_sample_type */
- };
- 
-+#define perf_flags(attr)	(*(&(attr)->read_format + 1))
-+
- /*
-  * Ioctls that can be done on a perf event fd:
-  */
-@@ -925,7 +927,7 @@ struct perf_event {
- 	struct hw_perf_event		hw;
- 
- 	struct perf_event_context	*ctx;
--	struct file			*filp;
-+	atomic_long_t			refcount;
- 
- 	/*
- 	 * These accumulate total time (in nanoseconds) that children
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 4a1f493..e63650f 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1244,6 +1244,9 @@ struct task_struct {
- 	const struct sched_class *sched_class;
- 	struct sched_entity se;
- 	struct sched_rt_entity rt;
-+#ifdef CONFIG_CGROUP_SCHED
-+	struct task_group *sched_task_group;
-+#endif
- 
- #ifdef CONFIG_PREEMPT_NOTIFIERS
- 	/* list of struct preempt_notifier: */
-@@ -2723,7 +2726,7 @@ extern int sched_group_set_rt_period(struct task_group *tg,
- extern long sched_group_rt_period(struct task_group *tg);
- extern int sched_rt_can_attach(struct task_group *tg, struct task_struct *tsk);
- #endif
--#endif
-+#endif /* CONFIG_CGROUP_SCHED */
- 
- extern int task_can_switch_user(struct user_struct *up,
- 					struct task_struct *tsk);
-diff --git a/include/linux/security.h b/include/linux/security.h
-index 3dea6a9..d143b8e 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -118,6 +118,7 @@ void reset_security_ops(void);
- extern unsigned long mmap_min_addr;
- extern unsigned long dac_mmap_min_addr;
- #else
-+#define mmap_min_addr		0UL
- #define dac_mmap_min_addr	0UL
- #endif
- 
-diff --git a/include/linux/time.h b/include/linux/time.h
-index c81c5e4..b51e664 100644
---- a/include/linux/time.h
-+++ b/include/linux/time.h
-@@ -107,11 +107,36 @@ static inline struct timespec timespec_sub(struct timespec lhs,
- 	return ts_delta;
- }
- 
-+#define KTIME_MAX			((s64)~((u64)1 << 63))
-+#if (BITS_PER_LONG == 64)
-+# define KTIME_SEC_MAX			(KTIME_MAX / NSEC_PER_SEC)
-+#else
-+# define KTIME_SEC_MAX			LONG_MAX
-+#endif
-+
- /*
-  * Returns true if the timespec is norm, false if denorm:
-  */
--#define timespec_valid(ts) \
--	(((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC))
-+static inline bool timespec_valid(const struct timespec *ts)
-+{
-+	/* Dates before 1970 are bogus */
-+	if (ts->tv_sec < 0)
-+		return false;
-+	/* Can't have more nanoseconds then a second */
-+	if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
-+		return false;
-+	return true;
-+}
-+
-+static inline bool timespec_valid_strict(const struct timespec *ts)
-+{
-+	if (!timespec_valid(ts))
-+		return false;
-+	/* Disallow values that could overflow ktime_t */
-+	if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
-+		return false;
-+	return true;
-+}
- 
- extern void read_persistent_clock(struct timespec *ts);
- extern void read_boot_clock(struct timespec *ts);
-diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
-index ca356a7..8b27927 100644
---- a/include/net/bluetooth/smp.h
-+++ b/include/net/bluetooth/smp.h
-@@ -136,7 +136,7 @@ struct smp_chan {
- };
- 
- /* SMP Commands */
--int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
-+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);
- int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
- int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
- int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey);
-diff --git a/include/net/codel.h b/include/net/codel.h
-index 550debf..389cf62 100644
---- a/include/net/codel.h
-+++ b/include/net/codel.h
-@@ -305,6 +305,8 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch,
- 			}
- 		}
- 	} else if (drop) {
-+		u32 delta;
-+
- 		if (params->ecn && INET_ECN_set_ce(skb)) {
- 			stats->ecn_mark++;
- 		} else {
-@@ -320,9 +322,11 @@ static struct sk_buff *codel_dequeue(struct Qdisc *sch,
- 		 * assume that the drop rate that controlled the queue on the
- 		 * last cycle is a good starting point to control it now.
- 		 */
--		if (codel_time_before(now - vars->drop_next,
-+		delta = vars->count - vars->lastcount;
-+		if (delta > 1 &&
-+		    codel_time_before(now - vars->drop_next,
- 				      16 * params->interval)) {
--			vars->count = (vars->count - vars->lastcount) | 1;
-+			vars->count = delta;
- 			/* we dont care if rec_inv_sqrt approximation
- 			 * is not very precise :
- 			 * Next Newton steps will correct it quadratically.
-diff --git a/include/net/scm.h b/include/net/scm.h
-index d456f4c..0c0017c 100644
---- a/include/net/scm.h
-+++ b/include/net/scm.h
-@@ -71,9 +71,11 @@ static __inline__ void scm_destroy(struct scm_cookie *scm)
- }
- 
- static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
--			       struct scm_cookie *scm)
-+			       struct scm_cookie *scm, bool forcecreds)
- {
- 	memset(scm, 0, sizeof(*scm));
-+	if (forcecreds)
-+		scm_set_cred(scm, task_tgid(current), current_cred());
- 	unix_get_peersec_dgram(sock, scm);
- 	if (msg->msg_controllen <= 0)
- 		return 0;
-diff --git a/include/net/sock.h b/include/net/sock.h
-index 4a45216..5de6557 100644
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -217,6 +217,7 @@ struct cg_proto;
-   *	@sk_route_nocaps: forbidden route capabilities (e.g NETIF_F_GSO_MASK)
-   *	@sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4)
-   *	@sk_gso_max_size: Maximum GSO segment size to build
-+  *	@sk_gso_max_segs: Maximum number of GSO segments
-   *	@sk_lingertime: %SO_LINGER l_linger setting
-   *	@sk_backlog: always used with the per-socket spinlock held
-   *	@sk_callback_lock: used with the callbacks in the end of this struct
-@@ -336,6 +337,7 @@ struct sock {
- 	netdev_features_t	sk_route_nocaps;
- 	int			sk_gso_type;
- 	unsigned int		sk_gso_max_size;
-+	u16			sk_gso_max_segs;
- 	int			sk_rcvlowat;
- 	unsigned long	        sk_lingertime;
- 	struct sk_buff_head	sk_error_queue;
-diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
-index 5f889f1..08fa272 100644
---- a/include/trace/events/kmem.h
-+++ b/include/trace/events/kmem.h
-@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,
- 
- 	TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
- 		__entry->page,
--		page_to_pfn(__entry->page),
-+		__entry->page ? page_to_pfn(__entry->page) : 0,
- 		__entry->order,
- 		__entry->migratetype,
- 		show_gfp_flags(__entry->gfp_flags))
-@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,
- 
- 	TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
- 		__entry->page,
--		page_to_pfn(__entry->page),
-+		__entry->page ? page_to_pfn(__entry->page) : 0,
- 		__entry->order,
- 		__entry->migratetype,
- 		__entry->order == 0)
-diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
-index 11e27c3..f19fff8 100644
---- a/include/xen/grant_table.h
-+++ b/include/xen/grant_table.h
-@@ -187,6 +187,7 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
- 		    struct gnttab_map_grant_ref *kmap_ops,
- 		    struct page **pages, unsigned int count);
- int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
--		      struct page **pages, unsigned int count, bool clear_pte);
-+		      struct gnttab_map_grant_ref *kunmap_ops,
-+		      struct page **pages, unsigned int count);
- 
- #endif /* __ASM_GNTTAB_H__ */
-diff --git a/kernel/async.c b/kernel/async.c
-index bd0c168..32d8dc9 100644
---- a/kernel/async.c
-+++ b/kernel/async.c
-@@ -86,6 +86,13 @@ static async_cookie_t  __lowest_in_progress(struct list_head *running)
- {
- 	struct async_entry *entry;
- 
-+	if (!running) { /* just check the entry count */
-+		if (atomic_read(&entry_count))
-+			return 0; /* smaller than any cookie */
-+		else
-+			return next_cookie;
-+	}
-+
- 	if (!list_empty(running)) {
- 		entry = list_first_entry(running,
- 			struct async_entry, list);
-@@ -236,9 +243,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain);
-  */
- void async_synchronize_full(void)
- {
--	do {
--		async_synchronize_cookie(next_cookie);
--	} while (!list_empty(&async_running) || !list_empty(&async_pending));
-+	async_synchronize_cookie_domain(next_cookie, NULL);
- }
- EXPORT_SYMBOL_GPL(async_synchronize_full);
- 
-@@ -258,7 +263,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
- /**
-  * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
-  * @cookie: async_cookie_t to use as checkpoint
-- * @running: running list to synchronize on
-+ * @running: running list to synchronize on, NULL indicates all lists
-  *
-  * This function waits until all asynchronous function calls for the
-  * synchronization domain specified by the running list @list submitted
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index d7d71d6..11409af 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -2933,12 +2933,12 @@ EXPORT_SYMBOL_GPL(perf_event_release_kernel);
- /*
-  * Called when the last reference to the file is gone.
-  */
--static int perf_release(struct inode *inode, struct file *file)
-+static void put_event(struct perf_event *event)
- {
--	struct perf_event *event = file->private_data;
- 	struct task_struct *owner;
- 
--	file->private_data = NULL;
-+	if (!atomic_long_dec_and_test(&event->refcount))
-+		return;
- 
- 	rcu_read_lock();
- 	owner = ACCESS_ONCE(event->owner);
-@@ -2973,7 +2973,13 @@ static int perf_release(struct inode *inode, struct file *file)
- 		put_task_struct(owner);
- 	}
- 
--	return perf_event_release_kernel(event);
-+	perf_event_release_kernel(event);
-+}
-+
-+static int perf_release(struct inode *inode, struct file *file)
-+{
-+	put_event(file->private_data);
-+	return 0;
- }
- 
- u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
-@@ -3225,7 +3231,7 @@ unlock:
- 
- static const struct file_operations perf_fops;
- 
--static struct perf_event *perf_fget_light(int fd, int *fput_needed)
-+static struct file *perf_fget_light(int fd, int *fput_needed)
- {
- 	struct file *file;
- 
-@@ -3239,7 +3245,7 @@ static struct perf_event *perf_fget_light(int fd, int *fput_needed)
- 		return ERR_PTR(-EBADF);
- 	}
- 
--	return file->private_data;
-+	return file;
- }
- 
- static int perf_event_set_output(struct perf_event *event,
-@@ -3271,19 +3277,21 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- 
- 	case PERF_EVENT_IOC_SET_OUTPUT:
- 	{
-+		struct file *output_file = NULL;
- 		struct perf_event *output_event = NULL;
- 		int fput_needed = 0;
- 		int ret;
- 
- 		if (arg != -1) {
--			output_event = perf_fget_light(arg, &fput_needed);
--			if (IS_ERR(output_event))
--				return PTR_ERR(output_event);
-+			output_file = perf_fget_light(arg, &fput_needed);
-+			if (IS_ERR(output_file))
-+				return PTR_ERR(output_file);
-+			output_event = output_file->private_data;
- 		}
- 
- 		ret = perf_event_set_output(event, output_event);
- 		if (output_event)
--			fput_light(output_event->filp, fput_needed);
-+			fput_light(output_file, fput_needed);
- 
- 		return ret;
- 	}
-@@ -5922,6 +5930,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
- 
- 	mutex_init(&event->mmap_mutex);
- 
-+	atomic_long_set(&event->refcount, 1);
- 	event->cpu		= cpu;
- 	event->attr		= *attr;
- 	event->group_leader	= group_leader;
-@@ -6232,12 +6241,12 @@ SYSCALL_DEFINE5(perf_event_open,
- 		return event_fd;
- 
- 	if (group_fd != -1) {
--		group_leader = perf_fget_light(group_fd, &fput_needed);
--		if (IS_ERR(group_leader)) {
--			err = PTR_ERR(group_leader);
-+		group_file = perf_fget_light(group_fd, &fput_needed);
-+		if (IS_ERR(group_file)) {
-+			err = PTR_ERR(group_file);
- 			goto err_fd;
- 		}
--		group_file = group_leader->filp;
-+		group_leader = group_file->private_data;
- 		if (flags & PERF_FLAG_FD_OUTPUT)
- 			output_event = group_leader;
- 		if (flags & PERF_FLAG_FD_NO_GROUP)
-@@ -6372,7 +6381,6 @@ SYSCALL_DEFINE5(perf_event_open,
- 		put_ctx(gctx);
- 	}
- 
--	event->filp = event_file;
- 	WARN_ON_ONCE(ctx->parent_ctx);
- 	mutex_lock(&ctx->mutex);
- 
-@@ -6462,7 +6470,6 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
- 		goto err_free;
- 	}
- 
--	event->filp = NULL;
- 	WARN_ON_ONCE(ctx->parent_ctx);
- 	mutex_lock(&ctx->mutex);
- 	perf_install_in_context(ctx, event, cpu);
-@@ -6511,7 +6518,7 @@ static void sync_child_event(struct perf_event *child_event,
- 	 * Release the parent event, if this was the last
- 	 * reference to it.
- 	 */
--	fput(parent_event->filp);
-+	put_event(parent_event);
- }
- 
- static void
-@@ -6587,9 +6594,8 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
- 	 *
- 	 *   __perf_event_exit_task()
- 	 *     sync_child_event()
--	 *       fput(parent_event->filp)
--	 *         perf_release()
--	 *           mutex_lock(&ctx->mutex)
-+	 *       put_event()
-+	 *         mutex_lock(&ctx->mutex)
- 	 *
- 	 * But since its the parent context it won't be the same instance.
- 	 */
-@@ -6657,7 +6663,7 @@ static void perf_free_event(struct perf_event *event,
- 	list_del_init(&event->child_list);
- 	mutex_unlock(&parent->child_mutex);
- 
--	fput(parent->filp);
-+	put_event(parent);
- 
- 	perf_group_detach(event);
- 	list_del_event(event, ctx);
-@@ -6737,6 +6743,12 @@ inherit_event(struct perf_event *parent_event,
- 				           NULL, NULL);
- 	if (IS_ERR(child_event))
- 		return child_event;
-+
-+	if (!atomic_long_inc_not_zero(&parent_event->refcount)) {
-+		free_event(child_event);
-+		return NULL;
-+	}
-+
- 	get_ctx(child_ctx);
- 
- 	/*
-@@ -6778,14 +6790,6 @@ inherit_event(struct perf_event *parent_event,
- 	raw_spin_unlock_irqrestore(&child_ctx->lock, flags);
- 
- 	/*
--	 * Get a reference to the parent filp - we will fput it
--	 * when the child event exits. This is safe to do because
--	 * we are in the parent and we know that the filp still
--	 * exists and has a nonzero count:
--	 */
--	atomic_long_inc(&parent_event->filp->f_count);
--
--	/*
- 	 * Link this into the parent event's child list
- 	 */
- 	WARN_ON_ONCE(parent_event->ctx->parent_ctx);
-diff --git a/kernel/kthread.c b/kernel/kthread.c
-index 3d3de63..b579af5 100644
---- a/kernel/kthread.c
-+++ b/kernel/kthread.c
-@@ -360,16 +360,12 @@ repeat:
- 					struct kthread_work, node);
- 		list_del_init(&work->node);
- 	}
-+	worker->current_work = work;
- 	spin_unlock_irq(&worker->lock);
- 
- 	if (work) {
- 		__set_current_state(TASK_RUNNING);
- 		work->func(work);
--		smp_wmb();	/* wmb worker-b0 paired with flush-b1 */
--		work->done_seq = work->queue_seq;
--		smp_mb();	/* mb worker-b1 paired with flush-b0 */
--		if (atomic_read(&work->flushing))
--			wake_up_all(&work->done);
- 	} else if (!freezing(current))
- 		schedule();
- 
-@@ -378,6 +374,19 @@ repeat:
- }
- EXPORT_SYMBOL_GPL(kthread_worker_fn);
- 
-+/* insert @work before @pos in @worker */
-+static void insert_kthread_work(struct kthread_worker *worker,
-+			       struct kthread_work *work,
-+			       struct list_head *pos)
-+{
-+	lockdep_assert_held(&worker->lock);
-+
-+	list_add_tail(&work->node, pos);
-+	work->worker = worker;
-+	if (likely(worker->task))
-+		wake_up_process(worker->task);
-+}
-+
- /**
-  * queue_kthread_work - queue a kthread_work
-  * @worker: target kthread_worker
-@@ -395,10 +404,7 @@ bool queue_kthread_work(struct kthread_worker *worker,
- 
- 	spin_lock_irqsave(&worker->lock, flags);
- 	if (list_empty(&work->node)) {
--		list_add_tail(&work->node, &worker->work_list);
--		work->queue_seq++;
--		if (likely(worker->task))
--			wake_up_process(worker->task);
-+		insert_kthread_work(worker, work, &worker->work_list);
- 		ret = true;
- 	}
- 	spin_unlock_irqrestore(&worker->lock, flags);
-@@ -406,6 +412,18 @@ bool queue_kthread_work(struct kthread_worker *worker,
- }
- EXPORT_SYMBOL_GPL(queue_kthread_work);
- 
-+struct kthread_flush_work {
-+	struct kthread_work	work;
-+	struct completion	done;
-+};
-+
-+static void kthread_flush_work_fn(struct kthread_work *work)
-+{
-+	struct kthread_flush_work *fwork =
-+		container_of(work, struct kthread_flush_work, work);
-+	complete(&fwork->done);
-+}
-+
- /**
-  * flush_kthread_work - flush a kthread_work
-  * @work: work to flush
-@@ -414,39 +432,37 @@ EXPORT_SYMBOL_GPL(queue_kthread_work);
-  */
- void flush_kthread_work(struct kthread_work *work)
- {
--	int seq = work->queue_seq;
--
--	atomic_inc(&work->flushing);
-+	struct kthread_flush_work fwork = {
-+		KTHREAD_WORK_INIT(fwork.work, kthread_flush_work_fn),
-+		COMPLETION_INITIALIZER_ONSTACK(fwork.done),
-+	};
-+	struct kthread_worker *worker;
-+	bool noop = false;
- 
--	/*
--	 * mb flush-b0 paired with worker-b1, to make sure either
--	 * worker sees the above increment or we see done_seq update.
--	 */
--	smp_mb__after_atomic_inc();
-+retry:
-+	worker = work->worker;
-+	if (!worker)
-+		return;
- 
--	/* A - B <= 0 tests whether B is in front of A regardless of overflow */
--	wait_event(work->done, seq - work->done_seq <= 0);
--	atomic_dec(&work->flushing);
-+	spin_lock_irq(&worker->lock);
-+	if (work->worker != worker) {
-+		spin_unlock_irq(&worker->lock);
-+		goto retry;
-+	}
- 
--	/*
--	 * rmb flush-b1 paired with worker-b0, to make sure our caller
--	 * sees every change made by work->func().
--	 */
--	smp_mb__after_atomic_dec();
--}
--EXPORT_SYMBOL_GPL(flush_kthread_work);
-+	if (!list_empty(&work->node))
-+		insert_kthread_work(worker, &fwork.work, work->node.next);
-+	else if (worker->current_work == work)
-+		insert_kthread_work(worker, &fwork.work, worker->work_list.next);
-+	else
-+		noop = true;
- 
--struct kthread_flush_work {
--	struct kthread_work	work;
--	struct completion	done;
--};
-+	spin_unlock_irq(&worker->lock);
- 
--static void kthread_flush_work_fn(struct kthread_work *work)
--{
--	struct kthread_flush_work *fwork =
--		container_of(work, struct kthread_flush_work, work);
--	complete(&fwork->done);
-+	if (!noop)
-+		wait_for_completion(&fwork.done);
- }
-+EXPORT_SYMBOL_GPL(flush_kthread_work);
- 
- /**
-  * flush_kthread_worker - flush all current works on a kthread_worker
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 39c44fa..c04c9ff 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -1096,7 +1096,7 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu)
- 	 * a task's CPU. ->pi_lock for waking tasks, rq->lock for runnable tasks.
- 	 *
- 	 * sched_move_task() holds both and thus holding either pins the cgroup,
--	 * see set_task_rq().
-+	 * see task_group().
- 	 *
- 	 * Furthermore, all task_rq users should acquire both locks, see
- 	 * task_rq_lock().
-@@ -7596,6 +7596,7 @@ void sched_destroy_group(struct task_group *tg)
-  */
- void sched_move_task(struct task_struct *tsk)
- {
-+	struct task_group *tg;
- 	int on_rq, running;
- 	unsigned long flags;
- 	struct rq *rq;
-@@ -7610,6 +7611,12 @@ void sched_move_task(struct task_struct *tsk)
- 	if (unlikely(running))
- 		tsk->sched_class->put_prev_task(rq, tsk);
- 
-+	tg = container_of(task_subsys_state_check(tsk, cpu_cgroup_subsys_id,
-+				lockdep_is_held(&tsk->sighand->siglock)),
-+			  struct task_group, css);
-+	tg = autogroup_task_group(tsk, tg);
-+	tsk->sched_task_group = tg;
-+
- #ifdef CONFIG_FAIR_GROUP_SCHED
- 	if (tsk->sched_class->task_move_group)
- 		tsk->sched_class->task_move_group(tsk, on_rq);
-diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
-index 5cf093f..749f712 100644
---- a/kernel/sched/sched.h
-+++ b/kernel/sched/sched.h
-@@ -538,22 +538,19 @@ extern int group_balance_cpu(struct sched_group *sg);
- /*
-  * Return the group to which this tasks belongs.
-  *
-- * We use task_subsys_state_check() and extend the RCU verification with
-- * pi->lock and rq->lock because cpu_cgroup_attach() holds those locks for each
-- * task it moves into the cgroup. Therefore by holding either of those locks,
-- * we pin the task to the current cgroup.
-+ * We cannot use task_subsys_state() and friends because the cgroup
-+ * subsystem changes that value before the cgroup_subsys::attach() method
-+ * is called, therefore we cannot pin it and might observe the wrong value.
-+ *
-+ * The same is true for autogroup's p->signal->autogroup->tg, the autogroup
-+ * core changes this before calling sched_move_task().
-+ *
-+ * Instead we use a 'copy' which is updated from sched_move_task() while
-+ * holding both task_struct::pi_lock and rq::lock.
-  */
- static inline struct task_group *task_group(struct task_struct *p)
- {
--	struct task_group *tg;
--	struct cgroup_subsys_state *css;
--
--	css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
--			lockdep_is_held(&p->pi_lock) ||
--			lockdep_is_held(&task_rq(p)->lock));
--	tg = container_of(css, struct task_group, css);
--
--	return autogroup_task_group(p, tg);
-+	return p->sched_task_group;
- }
- 
- /* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
-diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
-index 4a08472..a057ed4 100644
---- a/kernel/time/tick-sched.c
-+++ b/kernel/time/tick-sched.c
-@@ -145,6 +145,7 @@ static void tick_nohz_update_jiffies(ktime_t now)
- 	tick_do_update_jiffies64(now);
- 	local_irq_restore(flags);
- 
-+	calc_load_exit_idle();
- 	touch_softlockup_watchdog();
- }
- 
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 3447cfa..63c88c1 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -384,7 +384,7 @@ int do_settimeofday(const struct timespec *tv)
- 	struct timespec ts_delta;
- 	unsigned long flags;
- 
--	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
-+	if (!timespec_valid_strict(tv))
- 		return -EINVAL;
- 
- 	write_seqlock_irqsave(&timekeeper.lock, flags);
-@@ -418,6 +418,8 @@ EXPORT_SYMBOL(do_settimeofday);
- int timekeeping_inject_offset(struct timespec *ts)
- {
- 	unsigned long flags;
-+	struct timespec tmp;
-+	int ret = 0;
- 
- 	if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
- 		return -EINVAL;
-@@ -426,10 +428,17 @@ int timekeeping_inject_offset(struct timespec *ts)
- 
- 	timekeeping_forward_now();
- 
-+	tmp = timespec_add(timekeeper.xtime,  *ts);
-+	if (!timespec_valid_strict(&tmp)) {
-+		ret = -EINVAL;
-+		goto error;
-+	}
-+
- 	timekeeper.xtime = timespec_add(timekeeper.xtime, *ts);
- 	timekeeper.wall_to_monotonic =
- 				timespec_sub(timekeeper.wall_to_monotonic, *ts);
- 
-+error: /* even if we error out, we forwarded the time, so call update */
- 	timekeeping_update(true);
- 
- 	write_sequnlock_irqrestore(&timekeeper.lock, flags);
-@@ -437,7 +446,7 @@ int timekeeping_inject_offset(struct timespec *ts)
- 	/* signal hrtimers about time change */
- 	clock_was_set();
- 
--	return 0;
-+	return ret;
- }
- EXPORT_SYMBOL(timekeeping_inject_offset);
- 
-@@ -597,7 +606,20 @@ void __init timekeeping_init(void)
- 	struct timespec now, boot;
- 
- 	read_persistent_clock(&now);
-+	if (!timespec_valid_strict(&now)) {
-+		pr_warn("WARNING: Persistent clock returned invalid value!\n"
-+			"         Check your CMOS/BIOS settings.\n");
-+		now.tv_sec = 0;
-+		now.tv_nsec = 0;
-+	}
-+
- 	read_boot_clock(&boot);
-+	if (!timespec_valid_strict(&boot)) {
-+		pr_warn("WARNING: Boot clock returned invalid value!\n"
-+			"         Check your CMOS/BIOS settings.\n");
-+		boot.tv_sec = 0;
-+		boot.tv_nsec = 0;
-+	}
- 
- 	seqlock_init(&timekeeper.lock);
- 
-@@ -643,7 +665,7 @@ static void update_sleep_time(struct timespec t)
-  */
- static void __timekeeping_inject_sleeptime(struct timespec *delta)
- {
--	if (!timespec_valid(delta)) {
-+	if (!timespec_valid_strict(delta)) {
- 		printk(KERN_WARNING "__timekeeping_inject_sleeptime: Invalid "
- 					"sleep delta value!\n");
- 		return;
-@@ -1033,6 +1055,10 @@ static void update_wall_time(void)
- #else
- 	offset = (clock->read(clock) - clock->cycle_last) & clock->mask;
- #endif
-+	/* Check if there's really nothing to do */
-+	if (offset < timekeeper.cycle_interval)
-+		goto out;
-+
- 	timekeeper.xtime_nsec = (s64)timekeeper.xtime.tv_nsec <<
- 						timekeeper.shift;
- 
-diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index bc63253..2016347 100644
---- a/kernel/workqueue.c
-+++ b/kernel/workqueue.c
-@@ -3441,14 +3441,17 @@ static int __cpuinit trustee_thread(void *__gcwq)
- 
- 	for_each_busy_worker(worker, i, pos, gcwq) {
- 		struct work_struct *rebind_work = &worker->rebind_work;
-+		unsigned long worker_flags = worker->flags;
- 
- 		/*
- 		 * Rebind_work may race with future cpu hotplug
- 		 * operations.  Use a separate flag to mark that
--		 * rebinding is scheduled.
-+		 * rebinding is scheduled.  The morphing should
-+		 * be atomic.
- 		 */
--		worker->flags |= WORKER_REBIND;
--		worker->flags &= ~WORKER_ROGUE;
-+		worker_flags |= WORKER_REBIND;
-+		worker_flags &= ~WORKER_ROGUE;
-+		ACCESS_ONCE(worker->flags) = worker_flags;
- 
- 		/* queue rebind_work, wq doesn't matter, use the default one */
- 		if (test_and_set_bit(WORK_STRUCT_PENDING_BIT,
-@@ -3628,18 +3631,17 @@ static int __devinit workqueue_cpu_down_callback(struct notifier_block *nfb,
- #ifdef CONFIG_SMP
- 
- struct work_for_cpu {
--	struct completion completion;
-+	struct work_struct work;
- 	long (*fn)(void *);
- 	void *arg;
- 	long ret;
- };
- 
--static int do_work_for_cpu(void *_wfc)
-+static void work_for_cpu_fn(struct work_struct *work)
- {
--	struct work_for_cpu *wfc = _wfc;
-+	struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
-+
- 	wfc->ret = wfc->fn(wfc->arg);
--	complete(&wfc->completion);
--	return 0;
- }
- 
- /**
-@@ -3654,19 +3656,11 @@ static int do_work_for_cpu(void *_wfc)
-  */
- long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
- {
--	struct task_struct *sub_thread;
--	struct work_for_cpu wfc = {
--		.completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
--		.fn = fn,
--		.arg = arg,
--	};
-+	struct work_for_cpu wfc = { .fn = fn, .arg = arg };
- 
--	sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
--	if (IS_ERR(sub_thread))
--		return PTR_ERR(sub_thread);
--	kthread_bind(sub_thread, cpu);
--	wake_up_process(sub_thread);
--	wait_for_completion(&wfc.completion);
-+	INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
-+	schedule_work_on(cpu, &wfc.work);
-+	flush_work(&wfc.work);
- 	return wfc.ret;
- }
- EXPORT_SYMBOL_GPL(work_on_cpu);
-diff --git a/lib/digsig.c b/lib/digsig.c
-index 286d558..8c0e629 100644
---- a/lib/digsig.c
-+++ b/lib/digsig.c
-@@ -163,9 +163,11 @@ static int digsig_verify_rsa(struct key *key,
- 	memcpy(out1 + head, p, l);
- 
- 	err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, &len);
-+	if (err)
-+		goto err;
- 
--	if (!err && len == hlen)
--		err = memcmp(out2, h, hlen);
-+	if (len != hlen || memcmp(out2, h, hlen))
-+		err = -EINVAL;
- 
- err:
- 	mpi_free(in);
-diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
-index 427bb29..0086ac9 100644
---- a/mm/memory_hotplug.c
-+++ b/mm/memory_hotplug.c
-@@ -126,9 +126,6 @@ static void register_page_bootmem_info_section(unsigned long start_pfn)
- 	struct mem_section *ms;
- 	struct page *page, *memmap;
- 
--	if (!pfn_valid(start_pfn))
--		return;
--
- 	section_nr = pfn_to_section_nr(start_pfn);
- 	ms = __nr_to_section(section_nr);
- 
-@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(struct pglist_data *pgdat)
- 	end_pfn = pfn + pgdat->node_spanned_pages;
- 
- 	/* register_section info */
--	for (; pfn < end_pfn; pfn += PAGES_PER_SECTION)
--		register_page_bootmem_info_section(pfn);
--
-+	for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
-+		/*
-+		 * Some platforms can assign the same pfn to multiple nodes - on
-+		 * node0 as well as nodeN.  To avoid registering a pfn against
-+		 * multiple nodes we check that this pfn does not already
-+		 * reside in some other node.
-+		 */
-+		if (pfn_valid(pfn) && (pfn_to_nid(pfn) == node))
-+			register_page_bootmem_info_section(pfn);
-+	}
- }
- #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
- 
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 201b508..34d879e 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -580,7 +580,7 @@ static inline void __free_one_page(struct page *page,
- 		combined_idx = buddy_idx & page_idx;
- 		higher_page = page + (combined_idx - page_idx);
- 		buddy_idx = __find_buddy_index(combined_idx, order + 1);
--		higher_buddy = page + (buddy_idx - combined_idx);
-+		higher_buddy = higher_page + (buddy_idx - combined_idx);
- 		if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
- 			list_add_tail(&page->lru,
- 				&zone->free_area[order].free_list[migratetype]);
-diff --git a/net/atm/common.c b/net/atm/common.c
-index b4b44db..0c0ad93 100644
---- a/net/atm/common.c
-+++ b/net/atm/common.c
-@@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
- 
- 		if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
- 			return -ENOTCONN;
-+		memset(&pvc, 0, sizeof(pvc));
- 		pvc.sap_family = AF_ATMPVC;
- 		pvc.sap_addr.itf = vcc->dev->number;
- 		pvc.sap_addr.vpi = vcc->vpi;
-diff --git a/net/atm/pvc.c b/net/atm/pvc.c
-index 3a73491..ae03240 100644
---- a/net/atm/pvc.c
-+++ b/net/atm/pvc.c
-@@ -95,6 +95,7 @@ static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
- 		return -ENOTCONN;
- 	*sockaddr_len = sizeof(struct sockaddr_atmpvc);
- 	addr = (struct sockaddr_atmpvc *)sockaddr;
-+	memset(addr, 0, sizeof(*addr));
- 	addr->sap_family = AF_ATMPVC;
- 	addr->sap_addr.itf = vcc->dev->number;
- 	addr->sap_addr.vpi = vcc->vpi;
-diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
-index 3f18a6e..d74947d 100644
---- a/net/bluetooth/hci_conn.c
-+++ b/net/bluetooth/hci_conn.c
-@@ -42,6 +42,7 @@
- 
- #include <net/bluetooth/bluetooth.h>
- #include <net/bluetooth/hci_core.h>
-+#include <net/bluetooth/smp.h>
- 
- static void hci_le_connect(struct hci_conn *conn)
- {
-@@ -627,6 +628,9 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
- {
- 	BT_DBG("conn %p", conn);
- 
-+	if (conn->type == LE_LINK)
-+		return smp_conn_security(conn, sec_level);
-+
- 	/* For sdp we don't need the link key. */
- 	if (sec_level == BT_SECURITY_SDP)
- 		return 1;
-diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
-index 411ace8..730ff46 100644
---- a/net/bluetooth/hci_core.c
-+++ b/net/bluetooth/hci_core.c
-@@ -753,6 +753,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
- 
- 	cancel_work_sync(&hdev->le_scan);
- 
-+	cancel_delayed_work(&hdev->power_off);
-+
- 	hci_req_cancel(hdev, ENODEV);
- 	hci_req_lock(hdev);
- 
-diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 5914623..bedc768 100644
---- a/net/bluetooth/hci_sock.c
-+++ b/net/bluetooth/hci_sock.c
-@@ -706,6 +706,7 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *add
- 	*addr_len = sizeof(*haddr);
- 	haddr->hci_family = AF_BLUETOOTH;
- 	haddr->hci_dev    = hdev->id;
-+	haddr->hci_channel= 0;
- 
- 	release_sock(sk);
- 	return 0;
-@@ -1016,6 +1017,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
- 		{
- 			struct hci_filter *f = &hci_pi(sk)->filter;
- 
-+			memset(&uf, 0, sizeof(uf));
- 			uf.type_mask = f->type_mask;
- 			uf.opcode    = f->opcode;
- 			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index 7568a6f..6204170 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -1184,14 +1184,15 @@ clean:
- static void l2cap_conn_ready(struct l2cap_conn *conn)
- {
- 	struct l2cap_chan *chan;
-+	struct hci_conn *hcon = conn->hcon;
- 
- 	BT_DBG("conn %p", conn);
- 
--	if (!conn->hcon->out && conn->hcon->type == LE_LINK)
-+	if (!hcon->out && hcon->type == LE_LINK)
- 		l2cap_le_conn_ready(conn);
- 
--	if (conn->hcon->out && conn->hcon->type == LE_LINK)
--		smp_conn_security(conn, conn->hcon->pending_sec_level);
-+	if (hcon->out && hcon->type == LE_LINK)
-+		smp_conn_security(hcon, hcon->pending_sec_level);
- 
- 	mutex_lock(&conn->chan_lock);
- 
-@@ -1199,8 +1200,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
- 
- 		l2cap_chan_lock(chan);
- 
--		if (conn->hcon->type == LE_LINK) {
--			if (smp_conn_security(conn, chan->sec_level))
-+		if (hcon->type == LE_LINK) {
-+			if (smp_conn_security(hcon, chan->sec_level))
- 				l2cap_chan_ready(chan);
- 
- 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
-diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
-index 3bb1611..9c94d44 100644
---- a/net/bluetooth/l2cap_sock.c
-+++ b/net/bluetooth/l2cap_sock.c
-@@ -246,6 +246,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
- 
- 	BT_DBG("sock %p, sk %p", sock, sk);
- 
-+	memset(la, 0, sizeof(struct sockaddr_l2));
- 	addr->sa_family = AF_BLUETOOTH;
- 	*len = sizeof(struct sockaddr_l2);
- 
-@@ -595,7 +596,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
- 				break;
- 			}
- 
--			if (smp_conn_security(conn, sec.level))
-+			if (smp_conn_security(conn->hcon, sec.level))
- 				break;
- 			sk->sk_state = BT_CONFIG;
- 			chan->state = BT_CONFIG;
-diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
-index 3e5e336..3571450 100644
---- a/net/bluetooth/mgmt.c
-+++ b/net/bluetooth/mgmt.c
-@@ -2879,6 +2879,22 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
- 		if (scan)
- 			hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
- 
-+		if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
-+			u8 ssp = 1;
-+
-+			hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
-+		}
-+
-+		if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
-+			struct hci_cp_write_le_host_supported cp;
-+
-+			cp.le = 1;
-+			cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
-+
-+			hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
-+				     sizeof(cp), &cp);
-+		}
-+
- 		update_class(hdev);
- 		update_name(hdev, hdev->dev_name);
- 		update_eir(hdev);
-diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index e8707de..2df6956 100644
---- a/net/bluetooth/rfcomm/sock.c
-+++ b/net/bluetooth/rfcomm/sock.c
-@@ -547,6 +547,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
- 
- 	BT_DBG("sock %p, sk %p", sock, sk);
- 
-+	memset(sa, 0, sizeof(*sa));
- 	sa->rc_family  = AF_BLUETOOTH;
- 	sa->rc_channel = rfcomm_pi(sk)->channel;
- 	if (peer)
-@@ -841,6 +842,7 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
- 		}
- 
- 		sec.level = rfcomm_pi(sk)->sec_level;
-+		sec.key_size = 0;
- 
- 		len = min_t(unsigned int, len, sizeof(sec));
- 		if (copy_to_user(optval, (char *) &sec, len))
-diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
-index d1820ff..6435296 100644
---- a/net/bluetooth/rfcomm/tty.c
-+++ b/net/bluetooth/rfcomm/tty.c
-@@ -461,7 +461,7 @@ static int rfcomm_get_dev_list(void __user *arg)
- 
- 	size = sizeof(*dl) + dev_num * sizeof(*di);
- 
--	dl = kmalloc(size, GFP_KERNEL);
-+	dl = kzalloc(size, GFP_KERNEL);
- 	if (!dl)
- 		return -ENOMEM;
- 
-diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
-index 37df4e9..926043c 100644
---- a/net/bluetooth/smp.c
-+++ b/net/bluetooth/smp.c
-@@ -266,10 +266,10 @@ static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
- 	mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
- 			 hcon->dst_type, reason);
- 
--	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
--		cancel_delayed_work_sync(&conn->security_timer);
-+	cancel_delayed_work_sync(&conn->security_timer);
-+
-+	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
- 		smp_chan_destroy(conn);
--	}
- }
- 
- #define JUST_WORKS	0x00
-@@ -756,9 +756,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
- 	return 0;
- }
- 
--int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
-+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
- {
--	struct hci_conn *hcon = conn->hcon;
-+	struct l2cap_conn *conn = hcon->l2cap_data;
- 	struct smp_chan *smp = conn->smp_chan;
- 	__u8 authreq;
- 
-diff --git a/net/core/dev.c b/net/core/dev.c
-index a000840..e2215ee 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1055,6 +1055,8 @@ rollback:
-  */
- int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
- {
-+	char *new_ifalias;
-+
- 	ASSERT_RTNL();
- 
- 	if (len >= IFALIASZ)
-@@ -1068,9 +1070,10 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
- 		return 0;
- 	}
- 
--	dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
--	if (!dev->ifalias)
-+	new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-+	if (!new_ifalias)
- 		return -ENOMEM;
-+	dev->ifalias = new_ifalias;
- 
- 	strlcpy(dev->ifalias, alias, len+1);
- 	return len;
-@@ -1637,6 +1640,19 @@ static inline int deliver_skb(struct sk_buff *skb,
- 	return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
- }
- 
-+static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
-+{
-+	if (ptype->af_packet_priv == NULL)
-+		return false;
-+
-+	if (ptype->id_match)
-+		return ptype->id_match(ptype, skb->sk);
-+	else if ((struct sock *)ptype->af_packet_priv == skb->sk)
-+		return true;
-+
-+	return false;
-+}
-+
- /*
-  *	Support routine. Sends outgoing frames to any network
-  *	taps currently in use.
-@@ -1654,8 +1670,7 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
- 		 * they originated from - MvS (miquels@drinkel.ow.org)
- 		 */
- 		if ((ptype->dev == dev || !ptype->dev) &&
--		    (ptype->af_packet_priv == NULL ||
--		     (struct sock *)ptype->af_packet_priv != skb->sk)) {
-+		    (!skb_loop_sk(ptype, skb))) {
- 			if (pt_prev) {
- 				deliver_skb(skb2, pt_prev, skb->dev);
- 				pt_prev = ptype;
-@@ -2119,6 +2134,9 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
- 	__be16 protocol = skb->protocol;
- 	netdev_features_t features = skb->dev->features;
- 
-+	if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
-+		features &= ~NETIF_F_GSO_MASK;
-+
- 	if (protocol == htons(ETH_P_8021Q)) {
- 		struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
- 		protocol = veh->h_vlan_encapsulated_proto;
-@@ -5911,6 +5929,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
- 	dev_net_set(dev, &init_net);
- 
- 	dev->gso_max_size = GSO_MAX_SIZE;
-+	dev->gso_max_segs = GSO_MAX_SEGS;
- 
- 	INIT_LIST_HEAD(&dev->napi_list);
- 	INIT_LIST_HEAD(&dev->unreg_list);
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 9e5b71f..fcf8fdf 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1403,6 +1403,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
- 		} else {
- 			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
- 			sk->sk_gso_max_size = dst->dev->gso_max_size;
-+			sk->sk_gso_max_segs = dst->dev->gso_max_segs;
- 		}
- 	}
- }
-diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
-index 8c67bed..ce0d140 100644
---- a/net/dccp/ccids/ccid3.c
-+++ b/net/dccp/ccids/ccid3.c
-@@ -531,6 +531,7 @@ static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
- 	case DCCP_SOCKOPT_CCID_TX_INFO:
- 		if (len < sizeof(tfrc))
- 			return -EINVAL;
-+		memset(&tfrc, 0, sizeof(tfrc));
- 		tfrc.tfrctx_x	   = hc->tx_x;
- 		tfrc.tfrctx_x_recv = hc->tx_x_recv;
- 		tfrc.tfrctx_x_calc = hc->tx_x_calc;
-diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
-index c94bbc6..9be3d17 100644
---- a/net/ipv4/ipmr.c
-+++ b/net/ipv4/ipmr.c
-@@ -124,6 +124,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
- static struct kmem_cache *mrt_cachep __read_mostly;
- 
- static struct mr_table *ipmr_new_table(struct net *net, u32 id);
-+static void ipmr_free_table(struct mr_table *mrt);
-+
- static int ip_mr_forward(struct net *net, struct mr_table *mrt,
- 			 struct sk_buff *skb, struct mfc_cache *cache,
- 			 int local);
-@@ -131,6 +133,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
- 			     struct sk_buff *pkt, vifi_t vifi, int assert);
- static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
- 			      struct mfc_cache *c, struct rtmsg *rtm);
-+static void mroute_clean_tables(struct mr_table *mrt);
- static void ipmr_expire_process(unsigned long arg);
- 
- #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
-@@ -271,7 +274,7 @@ static void __net_exit ipmr_rules_exit(struct net *net)
- 
- 	list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
- 		list_del(&mrt->list);
--		kfree(mrt);
-+		ipmr_free_table(mrt);
- 	}
- 	fib_rules_unregister(net->ipv4.mr_rules_ops);
- }
-@@ -299,7 +302,7 @@ static int __net_init ipmr_rules_init(struct net *net)
- 
- static void __net_exit ipmr_rules_exit(struct net *net)
- {
--	kfree(net->ipv4.mrt);
-+	ipmr_free_table(net->ipv4.mrt);
- }
- #endif
- 
-@@ -336,6 +339,13 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
- 	return mrt;
- }
- 
-+static void ipmr_free_table(struct mr_table *mrt)
-+{
-+	del_timer_sync(&mrt->ipmr_expire_timer);
-+	mroute_clean_tables(mrt);
-+	kfree(mrt);
-+}
-+
- /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
- 
- static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 6fcd885..7ac0ce6 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -805,7 +805,9 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
- 			   old_size_goal + mss_now > xmit_size_goal)) {
- 			xmit_size_goal = old_size_goal;
- 		} else {
--			tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
-+			tp->xmit_size_goal_segs =
-+				min_t(u16, xmit_size_goal / mss_now,
-+				      sk->sk_gso_max_segs);
- 			xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
- 		}
- 	}
-diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
-index 04dbd7a..41ef65d 100644
---- a/net/ipv4/tcp_cong.c
-+++ b/net/ipv4/tcp_cong.c
-@@ -291,7 +291,8 @@ bool tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
- 	left = tp->snd_cwnd - in_flight;
- 	if (sk_can_gso(sk) &&
- 	    left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
--	    left * tp->mss_cache < sk->sk_gso_max_size)
-+	    left * tp->mss_cache < sk->sk_gso_max_size &&
-+	    left < sk->sk_gso_max_segs)
- 		return true;
- 	return left <= tcp_max_tso_deferred_mss(tp);
- }
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 05fe1f4..262316b 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -3107,13 +3107,14 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
-  * tcp_xmit_retransmit_queue().
-  */
- static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
--				  int newly_acked_sacked, bool is_dupack,
-+				  int prior_sacked, bool is_dupack,
- 				  int flag)
- {
- 	struct inet_connection_sock *icsk = inet_csk(sk);
- 	struct tcp_sock *tp = tcp_sk(sk);
- 	int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
- 				    (tcp_fackets_out(tp) > tp->reordering));
-+	int newly_acked_sacked = 0;
- 	int fast_rexmit = 0;
- 
- 	if (WARN_ON(!tp->packets_out && tp->sacked_out))
-@@ -3173,6 +3174,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
- 				tcp_add_reno_sack(sk);
- 		} else
- 			do_lost = tcp_try_undo_partial(sk, pkts_acked);
-+		newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
- 		break;
- 	case TCP_CA_Loss:
- 		if (flag & FLAG_DATA_ACKED)
-@@ -3194,6 +3196,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
- 			if (is_dupack)
- 				tcp_add_reno_sack(sk);
- 		}
-+		newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
- 
- 		if (icsk->icsk_ca_state <= TCP_CA_Disorder)
- 			tcp_try_undo_dsack(sk);
-@@ -3771,7 +3774,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
- 	int prior_packets;
- 	int prior_sacked = tp->sacked_out;
- 	int pkts_acked = 0;
--	int newly_acked_sacked = 0;
- 	bool frto_cwnd = false;
- 
- 	/* If the ack is older than previous acks
-@@ -3847,8 +3849,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
- 	flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
- 
- 	pkts_acked = prior_packets - tp->packets_out;
--	newly_acked_sacked = (prior_packets - prior_sacked) -
--			     (tp->packets_out - tp->sacked_out);
- 
- 	if (tp->frto_counter)
- 		frto_cwnd = tcp_process_frto(sk, flag);
-@@ -3862,7 +3862,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
- 		    tcp_may_raise_cwnd(sk, flag))
- 			tcp_cong_avoid(sk, ack, prior_in_flight);
- 		is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
--		tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
-+		tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
- 				      is_dupack, flag);
- 	} else {
- 		if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
-@@ -3877,7 +3877,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
- no_queue:
- 	/* If data was DSACKed, see if we can undo a cwnd reduction. */
- 	if (flag & FLAG_DSACKING_ACK)
--		tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
-+		tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
- 				      is_dupack, flag);
- 	/* If this ack opens up a zero window, clear backoff.  It was
- 	 * being used to time the probes, and is probably far higher than
-@@ -3897,8 +3897,7 @@ old_ack:
- 	 */
- 	if (TCP_SKB_CB(skb)->sacked) {
- 		flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
--		newly_acked_sacked = tp->sacked_out - prior_sacked;
--		tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
-+		tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
- 				      is_dupack, flag);
- 	}
- 
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 803cbfe..90b10d0 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1334,21 +1334,21 @@ static void tcp_cwnd_validate(struct sock *sk)
-  * when we would be allowed to send the split-due-to-Nagle skb fully.
-  */
- static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
--					unsigned int mss_now, unsigned int cwnd)
-+					unsigned int mss_now, unsigned int max_segs)
- {
- 	const struct tcp_sock *tp = tcp_sk(sk);
--	u32 needed, window, cwnd_len;
-+	u32 needed, window, max_len;
- 
- 	window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
--	cwnd_len = mss_now * cwnd;
-+	max_len = mss_now * max_segs;
- 
--	if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
--		return cwnd_len;
-+	if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
-+		return max_len;
- 
- 	needed = min(skb->len, window);
- 
--	if (cwnd_len <= needed)
--		return cwnd_len;
-+	if (max_len <= needed)
-+		return max_len;
- 
- 	return needed - needed % mss_now;
- }
-@@ -1577,7 +1577,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
- 	limit = min(send_win, cong_win);
- 
- 	/* If a full-sized TSO skb can be sent, do it. */
--	if (limit >= sk->sk_gso_max_size)
-+	if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
-+			   sk->sk_gso_max_segs * tp->mss_cache))
- 		goto send_now;
- 
- 	/* Middle in queue won't get any more data, full sendable already? */
-@@ -1803,7 +1804,9 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
- 		limit = mss_now;
- 		if (tso_segs > 1 && !tcp_urg_mode(tp))
- 			limit = tcp_mss_split_point(sk, skb, mss_now,
--						    cwnd_quota);
-+						    min_t(unsigned int,
-+							  cwnd_quota,
-+							  sk->sk_gso_max_segs));
- 
- 		if (skb->len > limit &&
- 		    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 8f6411c..938ba6d 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -493,8 +493,7 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
- 	struct net_device *dev;
- 	struct inet6_dev *idev;
- 
--	rcu_read_lock();
--	for_each_netdev_rcu(net, dev) {
-+	for_each_netdev(net, dev) {
- 		idev = __in6_dev_get(dev);
- 		if (idev) {
- 			int changed = (!idev->cnf.forwarding) ^ (!newf);
-@@ -503,7 +502,6 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
- 				dev_forward_change(idev);
- 		}
- 	}
--	rcu_read_unlock();
- }
- 
- static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
-diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
-index 32b2155..cb6584f7 100644
---- a/net/l2tp/l2tp_core.c
-+++ b/net/l2tp/l2tp_core.c
-@@ -1346,11 +1346,10 @@ static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
- 	/* Remove from tunnel list */
- 	spin_lock_bh(&pn->l2tp_tunnel_list_lock);
- 	list_del_rcu(&tunnel->list);
-+	kfree_rcu(tunnel, rcu);
- 	spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
--	synchronize_rcu();
- 
- 	atomic_dec(&l2tp_tunnel_count);
--	kfree(tunnel);
- }
- 
- /* Create a socket for the tunnel, if one isn't set up by
-diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
-index a38ec6c..56d583e 100644
---- a/net/l2tp/l2tp_core.h
-+++ b/net/l2tp/l2tp_core.h
-@@ -163,6 +163,7 @@ struct l2tp_tunnel_cfg {
- 
- struct l2tp_tunnel {
- 	int			magic;		/* Should be L2TP_TUNNEL_MAGIC */
-+	struct rcu_head rcu;
- 	rwlock_t		hlist_lock;	/* protect session_hlist */
- 	struct hlist_head	session_hlist[L2TP_HASH_SIZE];
- 						/* hashed list of sessions,
-diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
-index 35e1e4b..9275471 100644
---- a/net/l2tp/l2tp_ip6.c
-+++ b/net/l2tp/l2tp_ip6.c
-@@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
- 	lsa->l2tp_family = AF_INET6;
- 	lsa->l2tp_flowinfo = 0;
- 	lsa->l2tp_scope_id = 0;
-+	lsa->l2tp_unused = 0;
- 	if (peer) {
- 		if (!lsk->peer_conn_id)
- 			return -ENOTCONN;
-diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
-index fe5453c..a13c3e2 100644
---- a/net/llc/af_llc.c
-+++ b/net/llc/af_llc.c
-@@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
- 	struct sockaddr_llc sllc;
- 	struct sock *sk = sock->sk;
- 	struct llc_sock *llc = llc_sk(sk);
--	int rc = 0;
-+	int rc = -EBADF;
- 
- 	memset(&sllc, 0, sizeof(sllc));
- 	lock_sock(sk);
- 	if (sock_flag(sk, SOCK_ZAPPED))
- 		goto out;
- 	*uaddrlen = sizeof(sllc);
--	memset(uaddr, 0, *uaddrlen);
- 	if (peer) {
- 		rc = -ENOTCONN;
- 		if (sk->sk_state != TCP_ESTABLISHED)
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index 95ae431..92028de 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3270,6 +3270,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
- 	goto out_unlock;
- 
-  err_clear:
-+	memset(ifmgd->bssid, 0, ETH_ALEN);
-+	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
- 	ifmgd->auth_data = NULL;
-  err_free:
- 	kfree(auth_data);
-@@ -3449,6 +3451,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
- 	err = 0;
- 	goto out;
-  err_clear:
-+	memset(ifmgd->bssid, 0, ETH_ALEN);
-+	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
- 	ifmgd->assoc_data = NULL;
-  err_free:
- 	kfree(assoc_data);
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 84444dd..72bf32a 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -2759,6 +2759,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
- 	{
- 		struct ip_vs_timeout_user t;
- 
-+		memset(&t, 0, sizeof(t));
- 		__ip_vs_get_timeouts(net, &t);
- 		if (copy_to_user(user, &t, sizeof(t)) != 0)
- 			ret = -EFAULT;
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index b3025a6..20b32fd 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -1344,7 +1344,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
- 	if (NULL == siocb->scm)
- 		siocb->scm = &scm;
- 
--	err = scm_send(sock, msg, siocb->scm);
-+	err = scm_send(sock, msg, siocb->scm, true);
- 	if (err < 0)
- 		return err;
- 
-@@ -1355,7 +1355,8 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
- 		dst_pid = addr->nl_pid;
- 		dst_group = ffs(addr->nl_groups);
- 		err =  -EPERM;
--		if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
-+		if ((dst_group || dst_pid) &&
-+		    !netlink_capable(sock, NL_NONROOT_SEND))
- 			goto out;
- 	} else {
- 		dst_pid = nlk->dst_pid;
-@@ -2124,6 +2125,7 @@ static void __init netlink_add_usersock_entry(void)
- 	rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
- 	nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
- 	nl_table[NETLINK_USERSOCK].registered = 1;
-+	nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
- 
- 	netlink_table_ungrab();
- }
-diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
-index b6b1d7d..ce5348f 100644
---- a/net/openvswitch/vport-internal_dev.c
-+++ b/net/openvswitch/vport-internal_dev.c
-@@ -24,6 +24,9 @@
- #include <linux/ethtool.h>
- #include <linux/skbuff.h>
- 
-+#include <net/dst.h>
-+#include <net/xfrm.h>
-+
- #include "datapath.h"
- #include "vport-internal_dev.h"
- #include "vport-netdev.h"
-@@ -209,6 +212,11 @@ static int internal_dev_recv(struct vport *vport, struct sk_buff *skb)
- 	int len;
- 
- 	len = skb->len;
-+
-+	skb_dst_drop(skb);
-+	nf_reset(skb);
-+	secpath_reset(skb);
-+
- 	skb->dev = netdev;
- 	skb->pkt_type = PACKET_HOST;
- 	skb->protocol = eth_type_trans(skb, netdev);
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 0f66174..901cffd 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1280,6 +1280,14 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)
- 	spin_unlock(&f->lock);
- }
- 
-+bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
-+{
-+	if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
-+		return true;
-+
-+	return false;
-+}
-+
- static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
- {
- 	struct packet_sock *po = pkt_sk(sk);
-@@ -1332,6 +1340,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
- 		match->prot_hook.dev = po->prot_hook.dev;
- 		match->prot_hook.func = packet_rcv_fanout;
- 		match->prot_hook.af_packet_priv = match;
-+		match->prot_hook.id_match = match_fanout_group;
- 		dev_add_pack(&match->prot_hook);
- 		list_add(&match->list, &fanout_list);
- 	}
-@@ -1943,7 +1952,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
- 
- 	if (likely(po->tx_ring.pg_vec)) {
- 		ph = skb_shinfo(skb)->destructor_arg;
--		BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
- 		BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
- 		atomic_dec(&po->tx_ring.pending);
- 		__packet_set_status(po, ph, TP_STATUS_AVAILABLE);
-diff --git a/net/rds/recv.c b/net/rds/recv.c
-index 5c6e9f1..9f0f17c 100644
---- a/net/rds/recv.c
-+++ b/net/rds/recv.c
-@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
- 
- 	rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
- 
-+	msg->msg_namelen = 0;
-+
- 	if (msg_flags & MSG_OOB)
- 		goto out;
- 
-@@ -485,6 +487,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
- 			sin->sin_port = inc->i_hdr.h_sport;
- 			sin->sin_addr.s_addr = inc->i_saddr;
- 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
-+			msg->msg_namelen = sizeof(*sin);
- 		}
- 		break;
- 	}
-diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
-index f10fb82..05d60859 100644
---- a/net/sched/act_gact.c
-+++ b/net/sched/act_gact.c
-@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
- 	struct tcf_common *pc;
- 	int ret = 0;
- 	int err;
-+#ifdef CONFIG_GACT_PROB
-+	struct tc_gact_p *p_parm = NULL;
-+#endif
- 
- 	if (nla == NULL)
- 		return -EINVAL;
-@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
- #ifndef CONFIG_GACT_PROB
- 	if (tb[TCA_GACT_PROB] != NULL)
- 		return -EOPNOTSUPP;
-+#else
-+	if (tb[TCA_GACT_PROB]) {
-+		p_parm = nla_data(tb[TCA_GACT_PROB]);
-+		if (p_parm->ptype >= MAX_RAND)
-+			return -EINVAL;
-+	}
- #endif
- 
- 	pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
-@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
- 	spin_lock_bh(&gact->tcf_lock);
- 	gact->tcf_action = parm->action;
- #ifdef CONFIG_GACT_PROB
--	if (tb[TCA_GACT_PROB] != NULL) {
--		struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
-+	if (p_parm) {
- 		gact->tcfg_paction = p_parm->paction;
- 		gact->tcfg_pval    = p_parm->pval;
- 		gact->tcfg_ptype   = p_parm->ptype;
-@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb, const struct tc_action *a,
- 
- 	spin_lock(&gact->tcf_lock);
- #ifdef CONFIG_GACT_PROB
--	if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
-+	if (gact->tcfg_ptype)
- 		action = gact_rand[gact->tcfg_ptype](gact);
- 	else
- 		action = gact->tcf_action;
-diff --git a/net/socket.c b/net/socket.c
-index a990aa9..bce45cc 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -2658,6 +2658,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
- 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
- 		return -EFAULT;
- 
-+	memset(&ifc, 0, sizeof(ifc));
- 	if (ifc32.ifcbuf == 0) {
- 		ifc32.ifc_len = 0;
- 		ifc.ifc_len = 0;
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 641f2e4..9aa708c 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -1448,7 +1448,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
- 	if (NULL == siocb->scm)
- 		siocb->scm = &tmp_scm;
- 	wait_for_unix_gc();
--	err = scm_send(sock, msg, siocb->scm);
-+	err = scm_send(sock, msg, siocb->scm, false);
- 	if (err < 0)
- 		return err;
- 
-@@ -1617,7 +1617,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
- 	if (NULL == siocb->scm)
- 		siocb->scm = &tmp_scm;
- 	wait_for_unix_gc();
--	err = scm_send(sock, msg, siocb->scm);
-+	err = scm_send(sock, msg, siocb->scm, false);
- 	if (err < 0)
- 		return err;
- 
-diff --git a/net/wireless/reg.c b/net/wireless/reg.c
-index 460af03..b01449f 100644
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -340,6 +340,9 @@ static void reg_regdb_search(struct work_struct *work)
- 	struct reg_regdb_search_request *request;
- 	const struct ieee80211_regdomain *curdom, *regdom;
- 	int i, r;
-+	bool set_reg = false;
-+
-+	mutex_lock(&cfg80211_mutex);
- 
- 	mutex_lock(&reg_regdb_search_mutex);
- 	while (!list_empty(&reg_regdb_search_list)) {
-@@ -355,9 +358,7 @@ static void reg_regdb_search(struct work_struct *work)
- 				r = reg_copy_regd(&regdom, curdom);
- 				if (r)
- 					break;
--				mutex_lock(&cfg80211_mutex);
--				set_regdom(regdom);
--				mutex_unlock(&cfg80211_mutex);
-+				set_reg = true;
- 				break;
- 			}
- 		}
-@@ -365,6 +366,11 @@ static void reg_regdb_search(struct work_struct *work)
- 		kfree(request);
- 	}
- 	mutex_unlock(&reg_regdb_search_mutex);
-+
-+	if (set_reg)
-+		set_regdom(regdom);
-+
-+	mutex_unlock(&cfg80211_mutex);
- }
- 
- static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
-diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
-index 270790d..4cedc69 100644
---- a/sound/aoa/codecs/onyx.c
-+++ b/sound/aoa/codecs/onyx.c
-@@ -997,45 +997,10 @@ static void onyx_exit_codec(struct aoa_codec *codec)
- 	onyx->codec.soundbus_dev->detach_codec(onyx->codec.soundbus_dev, onyx);
- }
- 
--static int onyx_create(struct i2c_adapter *adapter,
--		       struct device_node *node,
--		       int addr)
--{
--	struct i2c_board_info info;
--	struct i2c_client *client;
--
--	memset(&info, 0, sizeof(struct i2c_board_info));
--	strlcpy(info.type, "aoa_codec_onyx", I2C_NAME_SIZE);
--	info.addr = addr;
--	info.platform_data = node;
--	client = i2c_new_device(adapter, &info);
--	if (!client)
--		return -ENODEV;
--
--	/*
--	 * We know the driver is already loaded, so the device should be
--	 * already bound. If not it means binding failed, which suggests
--	 * the device doesn't really exist and should be deleted.
--	 * Ideally this would be replaced by better checks _before_
--	 * instantiating the device.
--	 */
--	if (!client->driver) {
--		i2c_unregister_device(client);
--		return -ENODEV;
--	}
--
--	/*
--	 * Let i2c-core delete that device on driver removal.
--	 * This is safe because i2c-core holds the core_lock mutex for us.
--	 */
--	list_add_tail(&client->detected, &client->driver->clients);
--	return 0;
--}
--
- static int onyx_i2c_probe(struct i2c_client *client,
- 			  const struct i2c_device_id *id)
- {
--	struct device_node *node = client->dev.platform_data;
-+	struct device_node *node = client->dev.of_node;
- 	struct onyx *onyx;
- 	u8 dummy;
- 
-@@ -1071,40 +1036,6 @@ static int onyx_i2c_probe(struct i2c_client *client,
- 	return -ENODEV;
- }
- 
--static int onyx_i2c_attach(struct i2c_adapter *adapter)
--{
--	struct device_node *busnode, *dev = NULL;
--	struct pmac_i2c_bus *bus;
--
--	bus = pmac_i2c_adapter_to_bus(adapter);
--	if (bus == NULL)
--		return -ENODEV;
--	busnode = pmac_i2c_get_bus_node(bus);
--
--	while ((dev = of_get_next_child(busnode, dev)) != NULL) {
--		if (of_device_is_compatible(dev, "pcm3052")) {
--			const u32 *addr;
--			printk(KERN_DEBUG PFX "found pcm3052\n");
--			addr = of_get_property(dev, "reg", NULL);
--			if (!addr)
--				return -ENODEV;
--			return onyx_create(adapter, dev, (*addr)>>1);
--		}
--	}
--
--	/* if that didn't work, try desperate mode for older
--	 * machines that have stuff missing from the device tree */
--
--	if (!of_device_is_compatible(busnode, "k2-i2c"))
--		return -ENODEV;
--
--	printk(KERN_DEBUG PFX "found k2-i2c, checking if onyx chip is on it\n");
--	/* probe both possible addresses for the onyx chip */
--	if (onyx_create(adapter, NULL, 0x46) == 0)
--		return 0;
--	return onyx_create(adapter, NULL, 0x47);
--}
--
- static int onyx_i2c_remove(struct i2c_client *client)
- {
- 	struct onyx *onyx = i2c_get_clientdata(client);
-@@ -1117,16 +1048,16 @@ static int onyx_i2c_remove(struct i2c_client *client)
- }
- 
- static const struct i2c_device_id onyx_i2c_id[] = {
--	{ "aoa_codec_onyx", 0 },
-+	{ "MAC,pcm3052", 0 },
- 	{ }
- };
-+MODULE_DEVICE_TABLE(i2c,onyx_i2c_id);
- 
- static struct i2c_driver onyx_driver = {
- 	.driver = {
- 		.name = "aoa_codec_onyx",
- 		.owner = THIS_MODULE,
- 	},
--	.attach_adapter = onyx_i2c_attach,
- 	.probe = onyx_i2c_probe,
- 	.remove = onyx_i2c_remove,
- 	.id_table = onyx_i2c_id,
-diff --git a/sound/aoa/codecs/tas.c b/sound/aoa/codecs/tas.c
-index 8e63d1f..c491ae0 100644
---- a/sound/aoa/codecs/tas.c
-+++ b/sound/aoa/codecs/tas.c
-@@ -883,43 +883,10 @@ static void tas_exit_codec(struct aoa_codec *codec)
- }
- 
- 
--static int tas_create(struct i2c_adapter *adapter,
--		       struct device_node *node,
--		       int addr)
--{
--	struct i2c_board_info info;
--	struct i2c_client *client;
--
--	memset(&info, 0, sizeof(struct i2c_board_info));
--	strlcpy(info.type, "aoa_codec_tas", I2C_NAME_SIZE);
--	info.addr = addr;
--	info.platform_data = node;
--
--	client = i2c_new_device(adapter, &info);
--	if (!client)
--		return -ENODEV;
--	/*
--	 * We know the driver is already loaded, so the device should be
--	 * already bound. If not it means binding failed, and then there
--	 * is no point in keeping the device instantiated.
--	 */
--	if (!client->driver) {
--		i2c_unregister_device(client);
--		return -ENODEV;
--	}
--
--	/*
--	 * Let i2c-core delete that device on driver removal.
--	 * This is safe because i2c-core holds the core_lock mutex for us.
--	 */
--	list_add_tail(&client->detected, &client->driver->clients);
--	return 0;
--}
--
- static int tas_i2c_probe(struct i2c_client *client,
- 			 const struct i2c_device_id *id)
- {
--	struct device_node *node = client->dev.platform_data;
-+	struct device_node *node = client->dev.of_node;
- 	struct tas *tas;
- 
- 	tas = kzalloc(sizeof(struct tas), GFP_KERNEL);
-@@ -953,47 +920,6 @@ static int tas_i2c_probe(struct i2c_client *client,
- 	return -EINVAL;
- }
- 
--static int tas_i2c_attach(struct i2c_adapter *adapter)
--{
--	struct device_node *busnode, *dev = NULL;
--	struct pmac_i2c_bus *bus;
--
--	bus = pmac_i2c_adapter_to_bus(adapter);
--	if (bus == NULL)
--		return -ENODEV;
--	busnode = pmac_i2c_get_bus_node(bus);
--
--	while ((dev = of_get_next_child(busnode, dev)) != NULL) {
--		if (of_device_is_compatible(dev, "tas3004")) {
--			const u32 *addr;
--			printk(KERN_DEBUG PFX "found tas3004\n");
--			addr = of_get_property(dev, "reg", NULL);
--			if (!addr)
--				continue;
--			return tas_create(adapter, dev, ((*addr) >> 1) & 0x7f);
--		}
--		/* older machines have no 'codec' node with a 'compatible'
--		 * property that says 'tas3004', they just have a 'deq'
--		 * node without any such property... */
--		if (strcmp(dev->name, "deq") == 0) {
--			const u32 *_addr;
--			u32 addr;
--			printk(KERN_DEBUG PFX "found 'deq' node\n");
--			_addr = of_get_property(dev, "i2c-address", NULL);
--			if (!_addr)
--				continue;
--			addr = ((*_addr) >> 1) & 0x7f;
--			/* now, if the address doesn't match any of the two
--			 * that a tas3004 can have, we cannot handle this.
--			 * I doubt it ever happens but hey. */
--			if (addr != 0x34 && addr != 0x35)
--				continue;
--			return tas_create(adapter, dev, addr);
--		}
--	}
--	return -ENODEV;
--}
--
- static int tas_i2c_remove(struct i2c_client *client)
- {
- 	struct tas *tas = i2c_get_clientdata(client);
-@@ -1011,16 +937,16 @@ static int tas_i2c_remove(struct i2c_client *client)
- }
- 
- static const struct i2c_device_id tas_i2c_id[] = {
--	{ "aoa_codec_tas", 0 },
-+	{ "MAC,tas3004", 0 },
- 	{ }
- };
-+MODULE_DEVICE_TABLE(i2c,tas_i2c_id);
- 
- static struct i2c_driver tas_driver = {
- 	.driver = {
- 		.name = "aoa_codec_tas",
- 		.owner = THIS_MODULE,
- 	},
--	.attach_adapter = tas_i2c_attach,
- 	.probe = tas_i2c_probe,
- 	.remove = tas_i2c_remove,
- 	.id_table = tas_i2c_id,
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index c0fa629..f1c6164 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -2325,6 +2325,7 @@ int snd_hda_codec_reset(struct hda_codec *codec)
- 	}
- 	if (codec->patch_ops.free)
- 		codec->patch_ops.free(codec);
-+	memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
- 	snd_hda_jack_tbl_clear(codec);
- 	codec->proc_widget_hook = NULL;
- 	codec->spec = NULL;
-@@ -2340,7 +2341,6 @@ int snd_hda_codec_reset(struct hda_codec *codec)
- 	codec->num_pcms = 0;
- 	codec->pcm_info = NULL;
- 	codec->preset = NULL;
--	memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
- 	codec->slave_dig_outs = NULL;
- 	codec->spdif_status_reset = 0;
- 	module_put(codec->owner);
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 44d2ab5..7faf28c 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -201,6 +201,7 @@ struct alc_spec {
- 	unsigned int vol_in_capsrc:1; /* use capsrc volume (ADC has no vol) */
- 	unsigned int parse_flags; /* passed to snd_hda_parse_pin_defcfg() */
- 	unsigned int shared_mic_hp:1; /* HP/Mic-in sharing */
-+	unsigned int no_primary_hp:1; /* Don't prefer HP pins to speaker pins */
- 
- 	/* auto-mute control */
- 	int automute_mode;
-@@ -4182,7 +4183,8 @@ static int alc_parse_auto_config(struct hda_codec *codec,
- 		return 0; /* can't find valid BIOS pin config */
- 	}
- 
--	if (cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
-+	if (!spec->no_primary_hp &&
-+	    cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
- 	    cfg->line_outs <= cfg->hp_outs) {
- 		/* use HP as primary out */
- 		cfg->speaker_outs = cfg->line_outs;
-@@ -4909,6 +4911,7 @@ enum {
- 	ALC889_FIXUP_DAC_ROUTE,
- 	ALC889_FIXUP_MBP_VREF,
- 	ALC889_FIXUP_IMAC91_VREF,
-+	ALC882_FIXUP_NO_PRIMARY_HP,
- };
- 
- static void alc889_fixup_coef(struct hda_codec *codec,
-@@ -5030,6 +5033,17 @@ static void alc889_fixup_imac91_vref(struct hda_codec *codec,
- 	spec->keep_vref_in_automute = 1;
- }
- 
-+/* Don't take HP output as primary
-+ * strangely, the speaker output doesn't work on VAIO Z through DAC 0x05
-+ */
-+static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
-+				       const struct alc_fixup *fix, int action)
-+{
-+	struct alc_spec *spec = codec->spec;
-+	if (action == ALC_FIXUP_ACT_PRE_PROBE)
-+		spec->no_primary_hp = 1;
-+}
-+
- static const struct alc_fixup alc882_fixups[] = {
- 	[ALC882_FIXUP_ABIT_AW9D_MAX] = {
- 		.type = ALC_FIXUP_PINS,
-@@ -5212,6 +5226,10 @@ static const struct alc_fixup alc882_fixups[] = {
- 		.chained = true,
- 		.chain_id = ALC882_FIXUP_GPIO1,
- 	},
-+	[ALC882_FIXUP_NO_PRIMARY_HP] = {
-+		.type = ALC_FIXUP_FUNC,
-+		.v.func = alc882_fixup_no_primary_hp,
-+	},
- };
- 
- static const struct snd_pci_quirk alc882_fixup_tbl[] = {
-@@ -5246,6 +5264,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
- 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
- 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
-+	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
- 
- 	/* All Apple entries are in codec SSIDs */
- 	SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
-@@ -5286,6 +5305,7 @@ static const struct alc_model_fixup alc882_fixup_models[] = {
- 	{.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"},
- 	{.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"},
- 	{.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
-+	{.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
- 	{}
- };
- 
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index d2f2264..b98aded 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -1075,7 +1075,7 @@ static struct snd_kcontrol_new stac_smux_mixer = {
- 
- static const char * const slave_pfxs[] = {
- 	"Front", "Surround", "Center", "LFE", "Side",
--	"Headphone", "Speaker", "IEC958",
-+	"Headphone", "Speaker", "IEC958", "PCM",
- 	NULL
- };
- 
-diff --git a/sound/pci/ice1712/prodigy_hifi.c b/sound/pci/ice1712/prodigy_hifi.c
-index 764cc93..075d5aa 100644
---- a/sound/pci/ice1712/prodigy_hifi.c
-+++ b/sound/pci/ice1712/prodigy_hifi.c
-@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
- }
- 
- static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1);
-+static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);
- 
- static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
-     {
-@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
- 	.info = ak4396_dac_vol_info,
- 	.get = ak4396_dac_vol_get,
- 	.put = ak4396_dac_vol_put,
--	.tlv = { .p = db_scale_wm_dac },
-+	.tlv = { .p = ak4396_db_scale },
-     },
- };
- 
-diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
-index 0418fa1..45f2faf 100644
---- a/sound/soc/codecs/wm2000.c
-+++ b/sound/soc/codecs/wm2000.c
-@@ -675,7 +675,7 @@ static int wm2000_resume(struct snd_soc_codec *codec)
- #endif
- 
- static const struct regmap_config wm2000_regmap = {
--	.reg_bits = 8,
-+	.reg_bits = 16,
- 	.val_bits = 8,
- };
- 
-diff --git a/sound/soc/samsung/dma.c b/sound/soc/samsung/dma.c
-index ddc6cde..2526eca 100644
---- a/sound/soc/samsung/dma.c
-+++ b/sound/soc/samsung/dma.c
-@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma_hardware = {
- 	.info			= SNDRV_PCM_INFO_INTERLEAVED |
- 				    SNDRV_PCM_INFO_BLOCK_TRANSFER |
- 				    SNDRV_PCM_INFO_MMAP |
--				    SNDRV_PCM_INFO_MMAP_VALID |
--				    SNDRV_PCM_INFO_PAUSE |
--				    SNDRV_PCM_INFO_RESUME,
-+				    SNDRV_PCM_INFO_MMAP_VALID,
- 	.formats		= SNDRV_PCM_FMTBIT_S16_LE |
- 				    SNDRV_PCM_FMTBIT_U16_LE |
- 				    SNDRV_PCM_FMTBIT_U8 |
-@@ -246,15 +244,11 @@ static int dma_trigger(struct snd_pcm_substream *substream, int cmd)
- 
- 	switch (cmd) {
- 	case SNDRV_PCM_TRIGGER_START:
--	case SNDRV_PCM_TRIGGER_RESUME:
--	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
- 		prtd->state |= ST_RUNNING;
- 		prtd->params->ops->trigger(prtd->params->ch);
- 		break;
- 
- 	case SNDRV_PCM_TRIGGER_STOP:
--	case SNDRV_PCM_TRIGGER_SUSPEND:
--	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
- 		prtd->state &= ~ST_RUNNING;
- 		prtd->params->ops->stop(prtd->params->ch);
- 		break;
-diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c
-index 32de700..2f272c5 100644
---- a/sound/soc/tegra/tegra_alc5632.c
-+++ b/sound/soc/tegra/tegra_alc5632.c
-@@ -92,7 +92,6 @@ static struct snd_soc_jack_gpio tegra_alc5632_hp_jack_gpio = {
- 	.name = "Headset detection",
- 	.report = SND_JACK_HEADSET,
- 	.debounce_time = 150,
--	.invert = 1,
- };
- 
- static const struct snd_soc_dapm_widget tegra_alc5632_dapm_widgets[] = {
-diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
-index d6e2bb4..060dccb 100644
---- a/sound/usb/endpoint.c
-+++ b/sound/usb/endpoint.c
-@@ -197,7 +197,13 @@ static void prepare_outbound_urb(struct snd_usb_endpoint *ep,
- 			/* no data provider, so send silence */
- 			unsigned int offs = 0;
- 			for (i = 0; i < ctx->packets; ++i) {
--				int counts = ctx->packet_size[i];
-+				int counts;
-+
-+				if (ctx->packet_size[i])
-+					counts = ctx->packet_size[i];
-+				else
-+					counts = snd_usb_endpoint_next_packet_size(ep);
-+
- 				urb->iso_frame_desc[i].offset = offs * ep->stride;
- 				urb->iso_frame_desc[i].length = counts * ep->stride;
- 				offs += counts;
-diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
-index fd5e982..f782ce1 100644
---- a/sound/usb/pcm.c
-+++ b/sound/usb/pcm.c
-@@ -1140,6 +1140,12 @@ static void retire_playback_urb(struct snd_usb_substream *subs,
- 	int processed = urb->transfer_buffer_length / stride;
- 	int est_delay;
- 
-+	/* ignore the delay accounting when procssed=0 is given, i.e.
-+	 * silent payloads are procssed before handling the actual data
-+	 */
-+	if (!processed)
-+		return;
-+
- 	spin_lock_irqsave(&subs->lock, flags);
- 	est_delay = snd_usb_pcm_delay(subs, runtime->rate);
- 	/* update delay with exact number of samples played */
diff --git a/3.5.5/0000_README b/3.5.6/0000_README
index 95939b8..2e0bf11 100644
--- a/3.5.5/0000_README
+++ b/3.5.6/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9.1-3.5.5-201210070828.patch
+Patch:	4420_grsecurity-2.9.1-3.5.6-201210071716.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.5.5/4420_grsecurity-2.9.1-3.5.5-201210070828.patch b/3.5.6/4420_grsecurity-2.9.1-3.5.6-201210071716.patch
index 5345b72..3a2e2b8 100644
--- a/3.5.5/4420_grsecurity-2.9.1-3.5.5-201210070828.patch
+++ b/3.5.6/4420_grsecurity-2.9.1-3.5.6-201210071716.patch
@@ -285,7 +285,7 @@ index 13d6166..8c235b6 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index b3dfc85..61372d3 100644
+index 75c7683..a1ee05c 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -13761,7 +13761,7 @@ index 7261083..5c12053 100644
  bogus_magic:
  	jmp	bogus_magic
 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
-index 73ef56c..0238021 100644
+index bda833c..a9bdd97 100644
 --- a/arch/x86/kernel/alternative.c
 +++ b/arch/x86/kernel/alternative.c
 @@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
@@ -31415,10 +31415,10 @@ index 8a8725c..afed796 100644
  			marker = list_first_entry(&queue->head,
  						 struct vmw_marker, head);
 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index 1f6957c..b579481 100644
+index 0e4d41e..dfd88b4 100644
 --- a/drivers/hid/hid-core.c
 +++ b/drivers/hid/hid-core.c
-@@ -2153,7 +2153,7 @@ static bool hid_ignore(struct hid_device *hdev)
+@@ -2163,7 +2163,7 @@ static bool hid_ignore(struct hid_device *hdev)
  
  int hid_add_device(struct hid_device *hdev)
  {
@@ -31427,7 +31427,7 @@ index 1f6957c..b579481 100644
  	int ret;
  
  	if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -2188,7 +2188,7 @@ int hid_add_device(struct hid_device *hdev)
+@@ -2198,7 +2198,7 @@ int hid_add_device(struct hid_device *hdev)
  	/* XXX hack, any other cleaner solution after the driver core
  	 * is converted to allow more than 20 bytes as the device name? */
  	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
@@ -33483,7 +33483,7 @@ index 35c94ff..20d4c17 100644
  				schedule_work(&sc->trigger_event);
  		}
 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
-index 2e227fb..44ead1f 100644
+index f220a69..512fd1c 100644
 --- a/drivers/md/dm-table.c
 +++ b/drivers/md/dm-table.c
 @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
@@ -33518,7 +33518,7 @@ index 3e2907f..c28851a 100644
  	pmd->bl_info.value_type.inc = data_block_inc;
  	pmd->bl_info.value_type.dec = data_block_dec;
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index e24143c..ce2f21a1 100644
+index 9ff3019..c119fde 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
 @@ -176,9 +176,9 @@ struct mapped_device {
@@ -33533,7 +33533,7 @@ index e24143c..ce2f21a1 100644
  	struct list_head uevent_list;
  	spinlock_t uevent_lock; /* Protect access to uevent_list */
  
-@@ -1845,8 +1845,8 @@ static struct mapped_device *alloc_dev(int minor)
+@@ -1865,8 +1865,8 @@ static struct mapped_device *alloc_dev(int minor)
  	rwlock_init(&md->map_lock);
  	atomic_set(&md->holders, 1);
  	atomic_set(&md->open_count, 0);
@@ -33544,7 +33544,7 @@ index e24143c..ce2f21a1 100644
  	INIT_LIST_HEAD(&md->uevent_list);
  	spin_lock_init(&md->uevent_lock);
  
-@@ -1980,7 +1980,7 @@ static void event_callback(void *context)
+@@ -2000,7 +2000,7 @@ static void event_callback(void *context)
  
  	dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
  
@@ -33553,7 +33553,7 @@ index e24143c..ce2f21a1 100644
  	wake_up(&md->eventq);
  }
  
-@@ -2622,18 +2622,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -2642,18 +2642,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
  
  uint32_t dm_next_uevent_seq(struct mapped_device *md)
  {
@@ -36793,7 +36793,7 @@ index b48c24f..dac0fbc 100644
  
  	/* These three are default values which can be overridden */
 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index 2b4261c..e01516c 100644
+index f9823f2..7bc3e81 100644
 --- a/drivers/scsi/hpsa.c
 +++ b/drivers/scsi/hpsa.c
 @@ -536,7 +536,7 @@ static inline u32 next_command(struct ctlr_info *h, u8 q)
@@ -37508,7 +37508,7 @@ index dae3873..bb4bee6 100644
  	disposition = scsi_decide_disposition(cmd);
  	if (disposition != SUCCESS &&
 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index bb7c482..7551a95 100644
+index 08d48a3..2be990d 100644
 --- a/drivers/scsi/scsi_sysfs.c
 +++ b/drivers/scsi/scsi_sysfs.c
 @@ -660,7 +660,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr,	\
@@ -37739,23 +37739,6 @@ index c7b5e8b..783d6cb 100644
  			return -EFAULT;
  
  	return 0;
-diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
-index 42cdafe..2769103 100644
---- a/drivers/staging/speakup/speakup_soft.c
-+++ b/drivers/staging/speakup/speakup_soft.c
-@@ -241,11 +241,11 @@ static ssize_t softsynth_read(struct file *fp, char *buf, size_t count,
- 			break;
- 		} else if (!initialized) {
- 			if (*init) {
--				ch = *init;
- 				init++;
- 			} else {
- 				initialized = 1;
- 			}
-+			ch = *init;
- 		} else {
- 			ch = synth_buffer_getc();
- 		}
 diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
 index 5d89c0f..9261317 100644
 --- a/drivers/staging/usbip/usbip_common.h
@@ -38277,10 +38260,10 @@ index 324467d..504cc25 100644
  	tty_port_tty_set(&ch->port, tty);
  	mutex_lock(&ch->port.mutex);
 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
-index c43b683..4dab83e 100644
+index 90dff82..08119c3 100644
 --- a/drivers/tty/n_gsm.c
 +++ b/drivers/tty/n_gsm.c
-@@ -1629,7 +1629,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
+@@ -1639,7 +1639,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
  	kref_init(&dlci->ref);
  	mutex_init(&dlci->mutex);
  	dlci->fifo = &dlci->_fifo;
@@ -38289,7 +38272,7 @@ index c43b683..4dab83e 100644
  		kfree(dlci);
  		return NULL;
  	}
-@@ -2895,7 +2895,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
+@@ -2909,7 +2909,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
  	if (dlci == NULL)
  		return -ENOMEM;
  	port = &dlci->port;
@@ -38299,10 +38282,10 @@ index c43b683..4dab83e 100644
  	dlci_get(dlci);
  	dlci_get(dlci->gsm->dlci[0]);
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index ee1c268..0e97caf 100644
+index 26f0d0e..b7c4273 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
-@@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2124,6 +2124,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -39032,7 +39015,7 @@ index bf6e238..d401c04 100644
  	tty_port_tty_set(port, tty);
  
 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
-index 48cc6f2..85584dd 100644
+index 770a854..e5d3db3 100644
 --- a/drivers/tty/vt/keyboard.c
 +++ b/drivers/tty/vt/keyboard.c
 @@ -659,6 +659,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
@@ -39052,7 +39035,7 @@ index 48cc6f2..85584dd 100644
  	fn_handler[value](vc);
  }
  
-@@ -1808,9 +1818,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
+@@ -1805,9 +1815,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
  	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
  		return -EFAULT;
  
@@ -39062,7 +39045,7 @@ index 48cc6f2..85584dd 100644
  	switch (cmd) {
  	case KDGKBENT:
  		/* Ensure another thread doesn't free it under us */
-@@ -1825,6 +1832,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
+@@ -1822,6 +1829,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
  		spin_unlock_irqrestore(&kbd_event_lock, flags);
  		return put_user(val, &user_kbe->kb_value);
  	case KDSKBENT:
@@ -39072,7 +39055,7 @@ index 48cc6f2..85584dd 100644
  		if (!perm)
  			return -EPERM;
  		if (!i && v == K_NOSUCHMAP) {
-@@ -1915,9 +1925,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+@@ -1912,9 +1922,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
  	int i, j, k;
  	int ret;
  
@@ -39082,7 +39065,7 @@ index 48cc6f2..85584dd 100644
  	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
  	if (!kbs) {
  		ret = -ENOMEM;
-@@ -1951,6 +1958,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+@@ -1948,6 +1955,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
  		kfree(kbs);
  		return ((p && *p) ? -EOVERFLOW : 0);
  	case KDSKBSENT:
@@ -42923,7 +42906,7 @@ index d146e18..12d1bd1 100644
  				fd_offset + ex.a_text);
  		if (error != N_DATADDR(ex)) {
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 1b52956..725eca7 100644
+index 0225fdd..9f0ef53 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -32,6 +32,7 @@
@@ -43592,7 +43575,7 @@ index 1b52956..725eca7 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1890,14 +2338,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1879,14 +2327,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -43609,7 +43592,7 @@ index 1b52956..725eca7 100644
  	return size;
  }
  
-@@ -1991,7 +2439,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1980,7 +2428,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -43618,7 +43601,7 @@ index 1b52956..725eca7 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -2005,10 +2453,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1994,10 +2442,12 @@ static int elf_core_dump(struct coredump_params *cprm)
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -43631,7 +43614,7 @@ index 1b52956..725eca7 100644
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -2022,7 +2472,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2011,7 +2461,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -43640,7 +43623,7 @@ index 1b52956..725eca7 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2033,6 +2483,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2022,6 +2472,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -43648,7 +43631,7 @@ index 1b52956..725eca7 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2057,7 +2508,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2046,7 +2497,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -43657,7 +43640,7 @@ index 1b52956..725eca7 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2066,6 +2517,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2055,6 +2506,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -43665,7 +43648,7 @@ index 1b52956..725eca7 100644
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2083,6 +2535,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2072,6 +2524,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -43673,7 +43656,7 @@ index 1b52956..725eca7 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2103,6 +2556,97 @@ out:
+@@ -2092,6 +2545,97 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -44653,37 +44636,10 @@ index 7e6c52d..94bc756 100644
  				/*
  				 * We'll have a dentry and an inode for
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 4123b92..5381f16 100644
+index 9560257..5381f16 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
-@@ -1132,6 +1132,8 @@ positive:
- 	return 1;
- 
- rename_retry:
-+	if (locked)
-+		goto again;
- 	locked = 1;
- 	write_seqlock(&rename_lock);
- 	goto again;
-@@ -1234,6 +1236,8 @@ out:
- rename_retry:
- 	if (found)
- 		return found;
-+	if (locked)
-+		goto again;
- 	locked = 1;
- 	write_seqlock(&rename_lock);
- 	goto again;
-@@ -3031,6 +3035,8 @@ resume:
- 	return;
- 
- rename_retry:
-+	if (locked)
-+		goto again;
- 	locked = 1;
- 	write_seqlock(&rename_lock);
- 	goto again;
-@@ -3154,7 +3160,7 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3160,7 +3160,7 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -49597,10 +49553,18 @@ index b1822dd..df622cb 100644
  
  	seq_putc(m, '\n');
 diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
-index 06e1cc1..aa6fbbf 100644
+index 06e1cc1..a6eba7d 100644
 --- a/fs/proc/proc_net.c
 +++ b/fs/proc/proc_net.c
-@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
+@@ -23,6 +23,7 @@
+ #include <linux/nsproxy.h>
+ #include <net/net_namespace.h>
+ #include <linux/seq_file.h>
++#include <linux/grsecurity.h>
+ 
+ #include "internal.h"
+ 
+@@ -105,6 +106,17 @@ static struct net *get_proc_task_net(struct inode *dir)
  	struct task_struct *task;
  	struct nsproxy *ns;
  	struct net *net = NULL;
diff --git a/3.5.5/4430_grsec-remove-localversion-grsec.patch b/3.5.6/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.5.5/4430_grsec-remove-localversion-grsec.patch
+++ b/3.5.6/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.5.5/4435_grsec-mute-warnings.patch b/3.5.6/4435_grsec-mute-warnings.patch
index e1a7a3c..e1a7a3c 100644
--- a/3.5.5/4435_grsec-mute-warnings.patch
+++ b/3.5.6/4435_grsec-mute-warnings.patch
diff --git a/3.5.5/4440_grsec-remove-protected-paths.patch b/3.5.6/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.5.5/4440_grsec-remove-protected-paths.patch
+++ b/3.5.6/4440_grsec-remove-protected-paths.patch
diff --git a/3.5.5/4450_grsec-kconfig-default-gids.patch b/3.5.6/4450_grsec-kconfig-default-gids.patch
index eb5154a..eb5154a 100644
--- a/3.5.5/4450_grsec-kconfig-default-gids.patch
+++ b/3.5.6/4450_grsec-kconfig-default-gids.patch
diff --git a/3.5.5/4465_selinux-avc_audit-log-curr_ip.patch b/3.5.6/4465_selinux-avc_audit-log-curr_ip.patch
index fd7ab67..fd7ab67 100644
--- a/3.5.5/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.5.6/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.5.5/4470_disable-compat_vdso.patch b/3.5.6/4470_disable-compat_vdso.patch
index 68af025..68af025 100644
--- a/3.5.5/4470_disable-compat_vdso.patch
+++ b/3.5.6/4470_disable-compat_vdso.patch