diff --git a/Makefile b/Makefile
index 2e4c860..e5cefec 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 13
 SUBLEVEL = 11
-EXTRAVERSION = -ckt27
+EXTRAVERSION = -ckt28
 NAME = King of Alienated Frog Porn
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-omap2/clockdomains7xx_data.c 
b/arch/arm/mach-omap2/clockdomains7xx_data.c
index 57d5df0..7581e03 100644
--- a/arch/arm/mach-omap2/clockdomains7xx_data.c
+++ b/arch/arm/mach-omap2/clockdomains7xx_data.c
@@ -331,7 +331,7 @@ static struct clockdomain l4per2_7xx_clkdm = {
        .dep_bit          = DRA7XX_L4PER2_STATDEP_SHIFT,
        .wkdep_srcs       = l4per2_wkup_sleep_deps,
        .sleepdep_srcs    = l4per2_wkup_sleep_deps,
-       .flags            = CLKDM_CAN_HWSUP_SWSUP,
+       .flags            = CLKDM_CAN_SWSUP,
 };
 
 static struct clockdomain mpu0_7xx_clkdm = {
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index bf0ed5d..239635b 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -58,6 +58,10 @@ config NO_IOPORT
 config STACKTRACE_SUPPORT
        def_bool y
 
+config ILLEGAL_POINTER_VALUE
+       hex
+       default 0xdead000000000000
+
 config LOCKDEP_SUPPORT
        def_bool y
 
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index 7ef22e3..0b8d26d 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -821,7 +821,7 @@ cas2_action:
        /* 64bit CAS */
 #ifdef CONFIG_64BIT
 19:    ldd,ma  0(%sr3,%r26), %r29
-       sub,=   %r29, %r25, %r0
+       sub,*=  %r29, %r25, %r0
        b,n     cas2_end
 20:    std,ma  %r24, 0(%sr3,%r26)
        copy    %r0, %r28
diff --git a/arch/powerpc/include/asm/pgtable-ppc64.h 
b/arch/powerpc/include/asm/pgtable-ppc64.h
index b26cc32..1050f9f 100644
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -135,7 +135,19 @@
 #define pte_iterate_hashed_end() } while(0)
 
 #ifdef CONFIG_PPC_HAS_HASH_64K
-#define pte_pagesize_index(mm, addr, pte)      get_slice_psize(mm, addr)
+/*
+ * We expect this to be called only for user addresses or kernel virtual
+ * addresses other than the linear mapping.
+ */
+#define pte_pagesize_index(mm, addr, pte)                      \
+       ({                                                      \
+               unsigned int psize;                             \
+               if (is_kernel_addr(addr))                       \
+                       psize = MMU_PAGE_4K;                    \
+               else                                            \
+                       psize = get_slice_psize(mm, addr);      \
+               psize;                                          \
+       })
 #else
 #define pte_pagesize_index(mm, addr, pte)      MMU_PAGE_4K
 #endif
diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
index 9bd52c6..14de138 100644
--- a/arch/powerpc/include/asm/rtas.h
+++ b/arch/powerpc/include/asm/rtas.h
@@ -255,6 +255,7 @@ extern void rtas_power_off(void);
 extern void rtas_halt(void);
 extern void rtas_os_term(char *str);
 extern int rtas_get_sensor(int sensor, int index, int *state);
+extern int rtas_get_sensor_fast(int sensor, int index, int *state);
 extern int rtas_get_power_level(int powerdomain, int *level);
 extern int rtas_set_power_level(int powerdomain, int level, int *setlevel);
 extern bool rtas_indicator_present(int token, int *maxindex);
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 4cf674d..c4bc8d6 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -584,6 +584,23 @@ int rtas_get_sensor(int sensor, int index, int *state)
 }
 EXPORT_SYMBOL(rtas_get_sensor);
 
+int rtas_get_sensor_fast(int sensor, int index, int *state)
+{
+       int token = rtas_token("get-sensor-state");
+       int rc;
+
+       if (token == RTAS_UNKNOWN_SERVICE)
+               return -ENOENT;
+
+       rc = rtas_call(token, 2, 2, state, sensor, index);
+       WARN_ON(rc == RTAS_BUSY || (rc >= RTAS_EXTENDED_DELAY_MIN &&
+                                   rc <= RTAS_EXTENDED_DELAY_MAX));
+
+       if (rc < 0)
+               return rtas_error_rc(rc);
+       return rc;
+}
+
 bool rtas_indicator_present(int token, int *maxindex)
 {
        int proplen, count, i;
diff --git a/arch/powerpc/platforms/pseries/ras.c 
b/arch/powerpc/platforms/pseries/ras.c
index 721c058..50fd3ac 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -187,7 +187,8 @@ static irqreturn_t ras_epow_interrupt(int irq, void *dev_id)
        int state;
        int critical;
 
-       status = rtas_get_sensor(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX, &state);
+       status = rtas_get_sensor_fast(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX,
+                                     &state);
 
        if (state > 3)
                critical = 1;           /* Time Critical */
diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c 
b/arch/x86/crypto/ghash-clmulni-intel_glue.c
index a8d6f69..4bcf841 100644
--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
+++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
@@ -291,6 +291,7 @@ static struct ahash_alg ghash_async_alg = {
                        .cra_name               = "ghash",
                        .cra_driver_name        = "ghash-clmulni",
                        .cra_priority           = 400,
+                       .cra_ctxsize            = sizeof(struct 
ghash_async_ctx),
                        .cra_flags              = CRYPTO_ALG_TYPE_AHASH | 
CRYPTO_ALG_ASYNC,
                        .cra_blocksize          = GHASH_BLOCK_SIZE,
                        .cra_type               = &crypto_ahash_type,
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index c8fb357..b479c50 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -376,12 +376,6 @@ static u64 __get_spte_lockless(u64 *sptep)
 {
        return ACCESS_ONCE(*sptep);
 }
-
-static bool __check_direct_spte_mmio_pf(u64 spte)
-{
-       /* It is valid if the spte is zapped. */
-       return spte == 0ull;
-}
 #else
 union split_spte {
        struct {
@@ -497,23 +491,6 @@ retry:
 
        return spte.spte;
 }
-
-static bool __check_direct_spte_mmio_pf(u64 spte)
-{
-       union split_spte sspte = (union split_spte)spte;
-       u32 high_mmio_mask = shadow_mmio_mask >> 32;
-
-       /* It is valid if the spte is zapped. */
-       if (spte == 0ull)
-               return true;
-
-       /* It is valid if the spte is being zapped. */
-       if (sspte.spte_low == 0ull &&
-           (sspte.spte_high & high_mmio_mask) == high_mmio_mask)
-               return true;
-
-       return false;
-}
 #endif
 
 static bool spte_is_locklessly_modifiable(u64 spte)
@@ -3209,21 +3186,6 @@ static bool quickly_check_mmio_pf(struct kvm_vcpu *vcpu, 
u64 addr, bool direct)
        return vcpu_match_mmio_gva(vcpu, addr);
 }
 
-
-/*
- * On direct hosts, the last spte is only allows two states
- * for mmio page fault:
- *   - It is the mmio spte
- *   - It is zapped or it is being zapped.
- *
- * This function completely checks the spte when the last spte
- * is not the mmio spte.
- */
-static bool check_direct_spte_mmio_pf(u64 spte)
-{
-       return __check_direct_spte_mmio_pf(spte);
-}
-
 static u64 walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr)
 {
        struct kvm_shadow_walk_iterator iterator;
@@ -3266,13 +3228,6 @@ int handle_mmio_page_fault_common(struct kvm_vcpu *vcpu, 
u64 addr, bool direct)
        }
 
        /*
-        * It's ok if the gva is remapped by other cpus on shadow guest,
-        * it's a BUG if the gfn is not a mmio page.
-        */
-       if (direct && !check_direct_spte_mmio_pf(spte))
-               return RET_MMIO_PF_BUG;
-
-       /*
         * If the page table is zapped by other cpus, let CPU fault again on
         * the address.
         */
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 4287f1f..948e91b 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -137,6 +137,7 @@ page_table_range_init_count(unsigned long start, unsigned 
long end)
 
        vaddr = start;
        pgd_idx = pgd_index(vaddr);
+       pmd_idx = pmd_index(vaddr);
 
        for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd_idx++) {
                for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
diff --git a/arch/xtensa/include/asm/traps.h b/arch/xtensa/include/asm/traps.h
index f2faa58..03d02df 100644
--- a/arch/xtensa/include/asm/traps.h
+++ b/arch/xtensa/include/asm/traps.h
@@ -24,30 +24,39 @@ static inline void spill_registers(void)
 {
 #if XCHAL_NUM_AREGS > 16
        __asm__ __volatile__ (
-               "       call12  1f\n"
+               "       call8   1f\n"
                "       _j      2f\n"
                "       retw\n"
                "       .align  4\n"
                "1:\n"
+#if XCHAL_NUM_AREGS == 32
+               "       _entry  a1, 32\n"
+               "       addi    a8, a0, 3\n"
+               "       _entry  a1, 16\n"
+               "       mov     a12, a12\n"
+               "       retw\n"
+#else
                "       _entry  a1, 48\n"
-               "       addi    a12, a0, 3\n"
-#if XCHAL_NUM_AREGS > 32
-               "       .rept   (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n"
+               "       call12  1f\n"
+               "       retw\n"
+               "       .align  4\n"
+               "1:\n"
+               "       .rept   (" __stringify(XCHAL_NUM_AREGS) " - 16) / 12\n"
                "       _entry  a1, 48\n"
                "       mov     a12, a0\n"
                "       .endr\n"
-#endif
-               "       _entry  a1, 48\n"
+               "       _entry  a1, 16\n"
 #if XCHAL_NUM_AREGS % 12 == 0
-               "       mov     a8, a8\n"
-#elif XCHAL_NUM_AREGS % 12 == 4
                "       mov     a12, a12\n"
-#elif XCHAL_NUM_AREGS % 12 == 8
+#elif XCHAL_NUM_AREGS % 12 == 4
                "       mov     a4, a4\n"
+#elif XCHAL_NUM_AREGS % 12 == 8
+               "       mov     a8, a8\n"
 #endif
                "       retw\n"
+#endif
                "2:\n"
-               : : : "a12", "a13", "memory");
+               : : : "a8", "a9", "memory");
 #else
        __asm__ __volatile__ (
                "       mov     a12, a12\n"
diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
index 4b8e636..250c52b 100644
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -568,12 +568,13 @@ user_exception_exit:
         *       (if we have restored WSBITS-1 frames).
         */
 
+2:
 #if XCHAL_HAVE_THREADPTR
        l32i    a3, a1, PT_THREADPTR
        wur     a3, threadptr
 #endif
 
-2:     j       common_exception_exit
+       j       common_exception_exit
 
        /* This is the kernel exception exit.
         * We avoided to do a MOVSP when we entered the exception, but we
@@ -1827,7 +1828,7 @@ ENDPROC(system_call)
        mov     a12, a0
        .endr
 #endif
-       _entry  a1, 48
+       _entry  a1, 16
 #if XCHAL_NUM_AREGS % 12 == 0
        mov     a8, a8
 #elif XCHAL_NUM_AREGS % 12 == 4
@@ -1851,7 +1852,7 @@ ENDPROC(system_call)
 
 ENTRY(_switch_to)
 
-       entry   a1, 16
+       entry   a1, 48
 
        mov     a11, a3                 # and 'next' (a3)
 
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index b91ce75..d2102c4 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -141,15 +141,26 @@ static ssize_t blk_mq_sysfs_completed_show(struct 
blk_mq_ctx *ctx, char *page)
 
 static ssize_t sysfs_list_show(char *page, struct list_head *list, char *msg)
 {
-       char *start_page = page;
        struct request *rq;
+       int len = snprintf(page, PAGE_SIZE - 1, "%s:\n", msg);
+
+       list_for_each_entry(rq, list, queuelist) {
+               const int rq_len = 2 * sizeof(rq) + 2;
+
+               /* if the output will be truncated */
+               if (PAGE_SIZE - 1 < len + rq_len) {
+                       /* backspacing if it can't hold '\t...\n' */
+                       if (PAGE_SIZE - 1 < len + 5)
+                               len -= rq_len;
+                       len += snprintf(page + len, PAGE_SIZE - 1 - len,
+                                       "\t...\n");
+                       break;
+               }
+               len += snprintf(page + len, PAGE_SIZE - 1 - len,
+                               "\t%p\n", rq);
+       }
 
-       page += sprintf(page, "%s:\n", msg);
-
-       list_for_each_entry(rq, list, queuelist)
-               page += sprintf(page, "\t%p\n", rq);
-
-       return page - start_page;
+       return len;
 }
 
 static ssize_t blk_mq_sysfs_rq_list_show(struct blk_mq_ctx *ctx, char *page)
diff --git a/drivers/auxdisplay/ks0108.c b/drivers/auxdisplay/ks0108.c
index 5b93852..0d75285 100644
--- a/drivers/auxdisplay/ks0108.c
+++ b/drivers/auxdisplay/ks0108.c
@@ -139,6 +139,7 @@ static int __init ks0108_init(void)
 
        ks0108_pardevice = parport_register_device(ks0108_parport, KS0108_NAME,
                NULL, NULL, NULL, PARPORT_DEV_EXCL, NULL);
+       parport_put_port(ks0108_parport);
        if (ks0108_pardevice == NULL) {
                printk(KERN_ERR KS0108_NAME ": ERROR: "
                        "parport didn't register new device\n");
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index 545c4de..cbe0b58 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -297,10 +297,10 @@ void * devres_get(struct device *dev, void *new_res,
        if (!dr) {
                add_dr(dev, &new_dr->node);
                dr = new_dr;
-               new_dr = NULL;
+               new_res = NULL;
        }
        spin_unlock_irqrestore(&dev->devres_lock, flags);
-       devres_free(new_dr);
+       devres_free(new_res);
 
        return dr->data;
 }
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index f081b81..7cc890b 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -362,9 +362,7 @@ int platform_device_add(struct platform_device *pdev)
 
        while (--i >= 0) {
                struct resource *r = &pdev->resource[i];
-               unsigned long type = resource_type(r);
-
-               if (type == IORESOURCE_MEM || type == IORESOURCE_IO)
+               if (r->parent)
                        release_resource(r);
        }
 
@@ -395,9 +393,7 @@ void platform_device_del(struct platform_device *pdev)
 
                for (i = 0; i < pdev->num_resources; i++) {
                        struct resource *r = &pdev->resource[i];
-                       unsigned long type = resource_type(r);
-
-                       if (type == IORESOURCE_MEM || type == IORESOURCE_IO)
+                       if (r->parent)
                                release_resource(r);
                }
        }
diff --git a/drivers/clk/versatile/clk-sp810.c 
b/drivers/clk/versatile/clk-sp810.c
index bf9b15a..b9e05bd 100644
--- a/drivers/clk/versatile/clk-sp810.c
+++ b/drivers/clk/versatile/clk-sp810.c
@@ -128,8 +128,8 @@ struct clk *clk_sp810_timerclken_of_get(struct 
of_phandle_args *clkspec,
 {
        struct clk_sp810 *sp810 = data;
 
-       if (WARN_ON(clkspec->args_count != 1 || clkspec->args[0] >
-                       ARRAY_SIZE(sp810->timerclken)))
+       if (WARN_ON(clkspec->args_count != 1 ||
+                   clkspec->args[0] >= ARRAY_SIZE(sp810->timerclken)))
                return NULL;
 
        return sp810->timerclken[clkspec->args[0]].clk;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c 
b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 33929d4..4c83206 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -912,6 +912,7 @@ i915_gem_execbuffer_move_to_active(struct list_head *vmas,
                u32 old_read = obj->base.read_domains;
                u32 old_write = obj->base.write_domain;
 
+               obj->dirty = 1; /* be paranoid  */
                obj->base.write_domain = obj->base.pending_write_domain;
                if (obj->base.write_domain == 0)
                        obj->base.pending_read_domains |= 
obj->base.read_domains;
@@ -920,7 +921,6 @@ i915_gem_execbuffer_move_to_active(struct list_head *vmas,
 
                i915_vma_move_to_active(vma, ring);
                if (obj->base.write_domain) {
-                       obj->dirty = 1;
                        obj->last_write_seqno = intel_ring_get_seqno(ring);
                        if (obj->pin_count) /* check for potential scanout */
                                intel_mark_fb_busy(obj, ring);
diff --git a/drivers/gpu/drm/qxl/qxl_display.c 
b/drivers/gpu/drm/qxl/qxl_display.c
index fb71c10..be728c8 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -136,9 +136,35 @@ static int qxl_add_monitors_config_modes(struct 
drm_connector *connector,
        *pwidth = head->width;
        *pheight = head->height;
        drm_mode_probed_add(connector, mode);
+       /* remember the last custom size for mode validation */
+       qdev->monitors_config_width = mode->hdisplay;
+       qdev->monitors_config_height = mode->vdisplay;
        return 1;
 }
 
+static struct mode_size {
+       int w;
+       int h;
+} common_modes[] = {
+       { 640,  480},
+       { 720,  480},
+       { 800,  600},
+       { 848,  480},
+       {1024,  768},
+       {1152,  768},
+       {1280,  720},
+       {1280,  800},
+       {1280,  854},
+       {1280,  960},
+       {1280, 1024},
+       {1440,  900},
+       {1400, 1050},
+       {1680, 1050},
+       {1600, 1200},
+       {1920, 1080},
+       {1920, 1200}
+};
+
 static int qxl_add_common_modes(struct drm_connector *connector,
                                 unsigned pwidth,
                                 unsigned pheight)
@@ -146,29 +172,6 @@ static int qxl_add_common_modes(struct drm_connector 
*connector,
        struct drm_device *dev = connector->dev;
        struct drm_display_mode *mode = NULL;
        int i;
-       struct mode_size {
-               int w;
-               int h;
-       } common_modes[] = {
-               { 640,  480},
-               { 720,  480},
-               { 800,  600},
-               { 848,  480},
-               {1024,  768},
-               {1152,  768},
-               {1280,  720},
-               {1280,  800},
-               {1280,  854},
-               {1280,  960},
-               {1280, 1024},
-               {1440,  900},
-               {1400, 1050},
-               {1680, 1050},
-               {1600, 1200},
-               {1920, 1080},
-               {1920, 1200}
-       };
-
        for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
                mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h,
                                    60, false, false, false);
@@ -746,11 +749,22 @@ static int qxl_conn_get_modes(struct drm_connector 
*connector)
 static int qxl_conn_mode_valid(struct drm_connector *connector,
                               struct drm_display_mode *mode)
 {
+       struct drm_device *ddev = connector->dev;
+       struct qxl_device *qdev = ddev->dev_private;
+       int i;
+
        /* TODO: is this called for user defined modes? (xrandr --add-mode)
         * TODO: check that the mode fits in the framebuffer */
-       DRM_DEBUG("%s: %dx%d status=%d\n", mode->name, mode->hdisplay,
-                 mode->vdisplay, mode->status);
-       return MODE_OK;
+
+       if(qdev->monitors_config_width == mode->hdisplay &&
+          qdev->monitors_config_height == mode->vdisplay)
+               return MODE_OK;
+
+       for (i = 0; i < ARRAY_SIZE(common_modes); i++) {
+               if (common_modes[i].w == mode->hdisplay && common_modes[i].h == 
mode->vdisplay)
+                       return MODE_OK;
+       }
+       return MODE_BAD;
 }
 
 static struct drm_encoder *qxl_best_encoder(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
index 7bda32f..cbed209 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -325,6 +325,8 @@ struct qxl_device {
        struct work_struct fb_work;
 
        struct drm_property *hotplug_mode_update_property;
+       int monitors_config_width;
+       int monitors_config_height;
 };
 
 /* forward declaration for QXL_INFO_IO */
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c 
b/drivers/gpu/drm/radeon/radeon_combios.c
index 8cac698..9c64a97 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3403,6 +3403,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
            rdev->pdev->subsystem_device == 0x30ae)
                return;
 
+       /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume
+        * - it hangs on resume inside the dynclk 1 table.
+        */
+       if (rdev->family == CHIP_RS480 &&
+           rdev->pdev->subsystem_vendor == 0x103c &&
+           rdev->pdev->subsystem_device == 0x280a)
+               return;
+
        /* DYN CLK 1 */
        table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
        if (table)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c 
b/drivers/gpu/drm/radeon/radeon_connectors.c
index 719cd0e..f5b9c8b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -80,6 +80,11 @@ void radeon_connector_hotplug(struct drm_connector 
*connector)
                        if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) 
{
                                drm_helper_connector_dpms(connector, 
DRM_MODE_DPMS_OFF);
                        } else if 
(radeon_dp_needs_link_train(radeon_connector)) {
+                               /* Don't try to start link training before we
+                                * have the dpcd */
+                               if (!radeon_dp_getdpcd(radeon_connector))
+                                       return;
+
                                /* set it to OFF so that 
drm_helper_connector_dpms()
                                 * won't return immediately since the current 
state
                                 * is ON at this point.
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 44df131..910efd0 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -180,7 +180,7 @@ static void hid_io_error(struct hid_device *hid)
        if (time_after(jiffies, usbhid->stop_retry)) {
 
                /* Retries failed, so do a port reset unless we lack bandwidth*/
-               if (test_bit(HID_NO_BANDWIDTH, &usbhid->iofl)
+               if (!test_bit(HID_NO_BANDWIDTH, &usbhid->iofl)
                     && !test_and_set_bit(HID_RESET_PENDING, &usbhid->iofl)) {
 
                        schedule_work(&usbhid->reset_work);
diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index ccfaf3a..ec1c20a 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -806,7 +806,7 @@ static struct adis16400_chip_info adis16400_chips[] = {
                .num_channels = ARRAY_SIZE(adis16448_channels),
                .flags = ADIS16400_HAS_PROD_ID |
                                ADIS16400_HAS_SERIAL_NUMBER,
-               .gyro_scale_micro = IIO_DEGREE_TO_RAD(10000), /* 0.01 deg/s */
+               .gyro_scale_micro = IIO_DEGREE_TO_RAD(40000), /* 0.04 deg/s */
                .accel_scale_micro = IIO_G_TO_M_S_2(833), /* 1/1200 g */
                .temp_scale_nano = 73860000, /* 0.07386 C */
                .temp_offset = 31000000 / 73860, /* 31 C = 0x00 */
diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index dd4206c..5e1b117 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -110,6 +110,10 @@
 struct adis16480_chip_info {
        unsigned int num_channels;
        const struct iio_chan_spec *channels;
+       unsigned int gyro_max_val;
+       unsigned int gyro_max_scale;
+       unsigned int accel_max_val;
+       unsigned int accel_max_scale;
 };
 
 struct adis16480 {
@@ -533,19 +537,21 @@ static int adis16480_set_filter_freq(struct iio_dev 
*indio_dev,
 static int adis16480_read_raw(struct iio_dev *indio_dev,
        const struct iio_chan_spec *chan, int *val, int *val2, long info)
 {
+       struct adis16480 *st = iio_priv(indio_dev);
+
        switch (info) {
        case IIO_CHAN_INFO_RAW:
                return adis_single_conversion(indio_dev, chan, 0, val);
        case IIO_CHAN_INFO_SCALE:
                switch (chan->type) {
                case IIO_ANGL_VEL:
-                       *val = 0;
-                       *val2 = IIO_DEGREE_TO_RAD(20000); /* 0.02 degree/sec */
-                       return IIO_VAL_INT_PLUS_MICRO;
+                       *val = st->chip_info->gyro_max_scale;
+                       *val2 = st->chip_info->gyro_max_val;
+                       return IIO_VAL_FRACTIONAL;
                case IIO_ACCEL:
-                       *val = 0;
-                       *val2 = IIO_G_TO_M_S_2(800); /* 0.8 mg */
-                       return IIO_VAL_INT_PLUS_MICRO;
+                       *val = st->chip_info->accel_max_scale;
+                       *val2 = st->chip_info->accel_max_val;
+                       return IIO_VAL_FRACTIONAL;
                case IIO_MAGN:
                        *val = 0;
                        *val2 = 100; /* 0.0001 gauss */
@@ -702,18 +708,39 @@ static const struct adis16480_chip_info 
adis16480_chip_info[] = {
        [ADIS16375] = {
                .channels = adis16485_channels,
                .num_channels = ARRAY_SIZE(adis16485_channels),
+               /*
+                * storing the value in rad/degree and the scale in degree
+                * gives us the result in rad and better precession than
+                * storing the scale directly in rad.
+                */
+               .gyro_max_val = IIO_RAD_TO_DEGREE(22887),
+               .gyro_max_scale = 300,
+               .accel_max_val = IIO_M_S_2_TO_G(21973),
+               .accel_max_scale = 18,
        },
        [ADIS16480] = {
                .channels = adis16480_channels,
                .num_channels = ARRAY_SIZE(adis16480_channels),
+               .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
+               .gyro_max_scale = 450,
+               .accel_max_val = IIO_M_S_2_TO_G(12500),
+               .accel_max_scale = 5,
        },
        [ADIS16485] = {
                .channels = adis16485_channels,
                .num_channels = ARRAY_SIZE(adis16485_channels),
+               .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
+               .gyro_max_scale = 450,
+               .accel_max_val = IIO_M_S_2_TO_G(20000),
+               .accel_max_scale = 5,
        },
        [ADIS16488] = {
                .channels = adis16480_channels,
                .num_channels = ARRAY_SIZE(adis16480_channels),
+               .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
+               .gyro_max_scale = 450,
+               .accel_max_val = IIO_M_S_2_TO_G(22500),
+               .accel_max_scale = 18,
        },
 };
 
diff --git a/drivers/iio/industrialio-buffer.c 
b/drivers/iio/industrialio-buffer.c
index d660c89..1d05805 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -67,7 +67,7 @@ unsigned int iio_buffer_poll(struct file *filp,
        struct iio_buffer *rb = indio_dev->buffer;
 
        if (!indio_dev->info)
-               return -ENODEV;
+               return 0;
 
        poll_wait(filp, &rb->pollq, wait);
        if (rb->stufftoread)
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index 7c35689..2a55ee1 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -77,7 +77,7 @@ static unsigned int iio_event_poll(struct file *filep,
        unsigned int events = 0;
 
        if (!indio_dev->info)
-               return -ENODEV;
+               return events;
 
        poll_wait(filep, &ev_int->wait, wait);
 
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index a283274..639557b 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -85,7 +85,7 @@
  */
 
 struct ib_uverbs_device {
-       struct kref                             ref;
+       atomic_t                                refcount;
        int                                     num_comp_vectors;
        struct completion                       comp;
        struct device                          *dev;
@@ -94,6 +94,7 @@ struct ib_uverbs_device {
        struct cdev                             cdev;
        struct rb_root                          xrcd_tree;
        struct mutex                            xrcd_tree_mutex;
+       struct kobject                          kobj;
 };
 
 struct ib_uverbs_event_file {
diff --git a/drivers/infiniband/core/uverbs_cmd.c 
b/drivers/infiniband/core/uverbs_cmd.c
index f1cc838..096e598 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2106,6 +2106,12 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                next->send_flags = user_wr->send_flags;
 
                if (is_ud) {
+                       if (next->opcode != IB_WR_SEND &&
+                           next->opcode != IB_WR_SEND_WITH_IMM) {
+                               ret = -EINVAL;
+                               goto out_put;
+                       }
+
                        next->wr.ud.ah = idr_read_ah(user_wr->wr.ud.ah,
                                                     file->ucontext);
                        if (!next->wr.ud.ah) {
@@ -2145,9 +2151,11 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
                                        user_wr->wr.atomic.compare_add;
                                next->wr.atomic.swap = user_wr->wr.atomic.swap;
                                next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
+                       case IB_WR_SEND:
                                break;
                        default:
-                               break;
+                               ret = -EINVAL;
+                               goto out_put;
                        }
                }
 
diff --git a/drivers/infiniband/core/uverbs_main.c 
b/drivers/infiniband/core/uverbs_main.c
index 08219fb..2e10ff9 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -127,14 +127,18 @@ static int (*uverbs_ex_cmd_table[])(struct ib_uverbs_file 
*file,
 static void ib_uverbs_add_one(struct ib_device *device);
 static void ib_uverbs_remove_one(struct ib_device *device);
 
-static void ib_uverbs_release_dev(struct kref *ref)
+static void ib_uverbs_release_dev(struct kobject *kobj)
 {
        struct ib_uverbs_device *dev =
-               container_of(ref, struct ib_uverbs_device, ref);
+               container_of(kobj, struct ib_uverbs_device, kobj);
 
-       complete(&dev->comp);
+       kfree(dev);
 }
 
+static struct kobj_type ib_uverbs_dev_ktype = {
+       .release = ib_uverbs_release_dev,
+};
+
 static void ib_uverbs_release_event_file(struct kref *ref)
 {
        struct ib_uverbs_event_file *file =
@@ -298,13 +302,19 @@ static int ib_uverbs_cleanup_ucontext(struct 
ib_uverbs_file *file,
        return context->device->dealloc_ucontext(context);
 }
 
+static void ib_uverbs_comp_dev(struct ib_uverbs_device *dev)
+{
+       complete(&dev->comp);
+}
+
 static void ib_uverbs_release_file(struct kref *ref)
 {
        struct ib_uverbs_file *file =
                container_of(ref, struct ib_uverbs_file, ref);
 
        module_put(file->device->ib_dev->owner);
-       kref_put(&file->device->ref, ib_uverbs_release_dev);
+       if (atomic_dec_and_test(&file->device->refcount))
+               ib_uverbs_comp_dev(file->device);
 
        kfree(file);
 }
@@ -733,9 +743,7 @@ static int ib_uverbs_open(struct inode *inode, struct file 
*filp)
        int ret;
 
        dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev);
-       if (dev)
-               kref_get(&dev->ref);
-       else
+       if (!atomic_inc_not_zero(&dev->refcount))
                return -ENXIO;
 
        if (!try_module_get(dev->ib_dev->owner)) {
@@ -756,6 +764,7 @@ static int ib_uverbs_open(struct inode *inode, struct file 
*filp)
        mutex_init(&file->mutex);
 
        filp->private_data = file;
+       kobject_get(&dev->kobj);
 
        return nonseekable_open(inode, filp);
 
@@ -763,13 +772,16 @@ err_module:
        module_put(dev->ib_dev->owner);
 
 err:
-       kref_put(&dev->ref, ib_uverbs_release_dev);
+       if (atomic_dec_and_test(&dev->refcount))
+               ib_uverbs_comp_dev(dev);
+
        return ret;
 }
 
 static int ib_uverbs_close(struct inode *inode, struct file *filp)
 {
        struct ib_uverbs_file *file = filp->private_data;
+       struct ib_uverbs_device *dev = file->device;
 
        ib_uverbs_cleanup_ucontext(file, file->ucontext);
 
@@ -777,6 +789,7 @@ static int ib_uverbs_close(struct inode *inode, struct file 
*filp)
                kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
 
        kref_put(&file->ref, ib_uverbs_release_file);
+       kobject_put(&dev->kobj);
 
        return 0;
 }
@@ -872,10 +885,11 @@ static void ib_uverbs_add_one(struct ib_device *device)
        if (!uverbs_dev)
                return;
 
-       kref_init(&uverbs_dev->ref);
+       atomic_set(&uverbs_dev->refcount, 1);
        init_completion(&uverbs_dev->comp);
        uverbs_dev->xrcd_tree = RB_ROOT;
        mutex_init(&uverbs_dev->xrcd_tree_mutex);
+       kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype);
 
        spin_lock(&map_lock);
        devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -902,6 +916,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
        cdev_init(&uverbs_dev->cdev, NULL);
        uverbs_dev->cdev.owner = THIS_MODULE;
        uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
+       uverbs_dev->cdev.kobj.parent = &uverbs_dev->kobj;
        kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", 
uverbs_dev->devnum);
        if (cdev_add(&uverbs_dev->cdev, base, 1))
                goto err_cdev;
@@ -932,9 +947,10 @@ err_cdev:
                clear_bit(devnum, overflow_map);
 
 err:
-       kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+       if (atomic_dec_and_test(&uverbs_dev->refcount))
+               ib_uverbs_comp_dev(uverbs_dev);
        wait_for_completion(&uverbs_dev->comp);
-       kfree(uverbs_dev);
+       kobject_put(&uverbs_dev->kobj);
        return;
 }
 
@@ -954,9 +970,10 @@ static void ib_uverbs_remove_one(struct ib_device *device)
        else
                clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, 
overflow_map);
 
-       kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+       if (atomic_dec_and_test(&uverbs_dev->refcount))
+               ib_uverbs_comp_dev(uverbs_dev);
        wait_for_completion(&uverbs_dev->comp);
-       kfree(uverbs_dev);
+       kobject_put(&uverbs_dev->kobj);
 }
 
 static char *uverbs_devnode(struct device *dev, umode_t *mode)
diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
index a251bec..890c23b 100644
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -169,9 +169,13 @@ int mlx4_ib_query_ah(struct ib_ah *ibah, struct ib_ah_attr 
*ah_attr)
        enum rdma_link_layer ll;
 
        memset(ah_attr, 0, sizeof *ah_attr);
-       ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
        ah_attr->port_num = be32_to_cpu(ah->av.ib.port_pd) >> 24;
        ll = rdma_port_get_link_layer(ibah->device, ah_attr->port_num);
+       if (ll == IB_LINK_LAYER_ETHERNET)
+               ah_attr->sl = be32_to_cpu(ah->av.eth.sl_tclass_flowlabel) >> 29;
+       else
+               ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
+
        ah_attr->dlid = ll == IB_LINK_LAYER_INFINIBAND ? 
be16_to_cpu(ah->av.ib.dlid) : 0;
        if (ah->av.ib.stat_rate)
                ah_attr->static_rate = ah->av.ib.stat_rate - 
MLX4_STAT_RATE_OFFSET;
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 25b2cdf..2c037a2 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -206,15 +206,16 @@ static int send_mad_to_wire(struct mlx4_ib_demux_ctx 
*ctx, struct ib_mad *mad)
 {
        struct mlx4_ib_dev *dev = ctx->dev;
        struct ib_ah_attr       ah_attr;
+       unsigned long flags;
 
-       spin_lock(&dev->sm_lock);
+       spin_lock_irqsave(&dev->sm_lock, flags);
        if (!dev->sm_ah[ctx->port - 1]) {
                /* port is not yet Active, sm_ah not ready */
-               spin_unlock(&dev->sm_lock);
+               spin_unlock_irqrestore(&dev->sm_lock, flags);
                return -EAGAIN;
        }
        mlx4_ib_query_ah(dev->sm_ah[ctx->port - 1], &ah_attr);
-       spin_unlock(&dev->sm_lock);
+       spin_unlock_irqrestore(&dev->sm_lock, flags);
        return mlx4_ib_send_to_wire(dev, mlx4_master_func_num(dev->dev), 
ctx->port,
                                    IB_QPT_GSI, 0, 1, IB_QP1_QKEY, &ah_attr, 
mad);
 }
diff --git a/drivers/infiniband/hw/mlx4/sysfs.c 
b/drivers/infiniband/hw/mlx4/sysfs.c
index 97516eb..c5ce408 100644
--- a/drivers/infiniband/hw/mlx4/sysfs.c
+++ b/drivers/infiniband/hw/mlx4/sysfs.c
@@ -563,6 +563,8 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, 
int slave)
        struct mlx4_port *p;
        int i;
        int ret;
+       int is_eth = rdma_port_get_link_layer(&dev->ib_dev, port_num) ==
+                       IB_LINK_LAYER_ETHERNET;
 
        p = kzalloc(sizeof *p, GFP_KERNEL);
        if (!p)
@@ -580,7 +582,8 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, 
int slave)
 
        p->pkey_group.name  = "pkey_idx";
        p->pkey_group.attrs =
-               alloc_group_attrs(show_port_pkey, store_port_pkey,
+               alloc_group_attrs(show_port_pkey,
+                                 is_eth ? NULL : store_port_pkey,
                                  dev->dev->caps.pkey_table_len[port_num]);
        if (!p->pkey_group.attrs)
                goto err_alloc;
diff --git a/drivers/infiniband/hw/qib/qib_keys.c 
b/drivers/infiniband/hw/qib/qib_keys.c
index 3b9afcc..eabe547 100644
--- a/drivers/infiniband/hw/qib/qib_keys.c
+++ b/drivers/infiniband/hw/qib/qib_keys.c
@@ -86,6 +86,10 @@ int qib_alloc_lkey(struct qib_mregion *mr, int dma_region)
         * unrestricted LKEY.
         */
        rkt->gen++;
+       /*
+        * bits are capped in qib_verbs.c to insure enough bits
+        * for generation number
+        */
        mr->lkey = (r << (32 - ib_qib_lkey_table_size)) |
                ((((1 << (24 - ib_qib_lkey_table_size)) - 1) & rkt->gen)
                 << 8);
diff --git a/drivers/infiniband/hw/qib/qib_verbs.c 
b/drivers/infiniband/hw/qib/qib_verbs.c
index 092b0bb..c141b9b 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.c
+++ b/drivers/infiniband/hw/qib/qib_verbs.c
@@ -40,6 +40,7 @@
 #include <linux/rculist.h>
 #include <linux/mm.h>
 #include <linux/random.h>
+#include <linux/vmalloc.h>
 
 #include "qib.h"
 #include "qib_common.h"
@@ -2086,10 +2087,16 @@ int qib_register_ib_device(struct qib_devdata *dd)
         * the LKEY).  The remaining bits act as a generation number or tag.
         */
        spin_lock_init(&dev->lk_table.lock);
+       /* insure generation is at least 4 bits see keys.c */
+       if (ib_qib_lkey_table_size > MAX_LKEY_TABLE_BITS) {
+               qib_dev_warn(dd, "lkey bits %u too large, reduced to %u\n",
+                       ib_qib_lkey_table_size, MAX_LKEY_TABLE_BITS);
+               ib_qib_lkey_table_size = MAX_LKEY_TABLE_BITS;
+       }
        dev->lk_table.max = 1 << ib_qib_lkey_table_size;
        lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table);
        dev->lk_table.table = (struct qib_mregion __rcu **)
-               __get_free_pages(GFP_KERNEL, get_order(lk_tab_size));
+               vmalloc(lk_tab_size);
        if (dev->lk_table.table == NULL) {
                ret = -ENOMEM;
                goto err_lk;
@@ -2262,7 +2269,7 @@ err_tx:
                                        sizeof(struct qib_pio_header),
                                  dev->pio_hdrs, dev->pio_hdrs_phys);
 err_hdrs:
-       free_pages((unsigned long) dev->lk_table.table, get_order(lk_tab_size));
+       vfree(dev->lk_table.table);
 err_lk:
        kfree(dev->qp_table);
 err_qpt:
@@ -2316,8 +2323,7 @@ void qib_unregister_ib_device(struct qib_devdata *dd)
                                        sizeof(struct qib_pio_header),
                                  dev->pio_hdrs, dev->pio_hdrs_phys);
        lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table);
-       free_pages((unsigned long) dev->lk_table.table,
-                  get_order(lk_tab_size));
+       vfree(dev->lk_table.table);
        kfree(dev->qp_table);
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_verbs.h 
b/drivers/infiniband/hw/qib/qib_verbs.h
index a01c7d2..d34bc69 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.h
+++ b/drivers/infiniband/hw/qib/qib_verbs.h
@@ -647,6 +647,8 @@ struct qib_qpn_table {
        struct qpn_map map[QPNMAP_ENTRIES];
 };
 
+#define MAX_LKEY_TABLE_BITS 23
+
 struct qib_lkey_table {
        spinlock_t lock; /* protect changes in this struct */
        u32 next;               /* next unused index (speeds search) */
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c33c8ff..e627bee 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -240,19 +240,14 @@ static int evdev_flush(struct file *file, fl_owner_t id)
 {
        struct evdev_client *client = file->private_data;
        struct evdev *evdev = client->evdev;
-       int retval;
 
-       retval = mutex_lock_interruptible(&evdev->mutex);
-       if (retval)
-               return retval;
+       mutex_lock(&evdev->mutex);
 
-       if (!evdev->exist || client->revoked)
-               retval = -ENODEV;
-       else
-               retval = input_flush_device(&evdev->handle, file);
+       if (evdev->exist && !client->revoked)
+               input_flush_device(&evdev->handle, file);
 
        mutex_unlock(&evdev->mutex);
-       return retval;
+       return 0;
 }
 
 static void evdev_free(struct device *dev)
diff --git a/drivers/macintosh/windfarm_core.c 
b/drivers/macintosh/windfarm_core.c
index 3ee198b..cc7ece1 100644
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -435,7 +435,7 @@ int wf_unregister_client(struct notifier_block *nb)
 {
        mutex_lock(&wf_lock);
        blocking_notifier_chain_unregister(&wf_client_list, nb);
-       wf_client_count++;
+       wf_client_count--;
        if (wf_client_count == 0)
                wf_stop_thread();
        mutex_unlock(&wf_lock);
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 006e57b..883d443 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -352,7 +352,7 @@ config DM_MULTIPATH
        # of SCSI_DH if the latter isn't defined but if
        # it is, DM_MULTIPATH must depend on it.  We get a build
        # error if SCSI_DH=m and DM_MULTIPATH=y
-       depends on SCSI_DH || !SCSI_DH
+       depends on !SCSI_DH || SCSI
        ---help---
          Allow volume managers to support multipath hardware.
 
diff --git a/drivers/media/platform/omap3isp/isp.c 
b/drivers/media/platform/omap3isp/isp.c
index 561bce8..1290c38 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -814,14 +814,14 @@ static int isp_pipeline_link_notify(struct media_link 
*link, u32 flags,
        int ret;
 
        if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
-           !(link->flags & MEDIA_LNK_FL_ENABLED)) {
+           !(flags & MEDIA_LNK_FL_ENABLED)) {
                /* Powering off entities is assumed to never fail. */
                isp_pipeline_pm_power(source, -sink_use);
                isp_pipeline_pm_power(sink, -source_use);
                return 0;
        }
 
-       if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
+       if (notification == MEDIA_DEV_NOTIFY_PRE_LINK_CH &&
                (flags & MEDIA_LNK_FL_ENABLED)) {
 
                ret = isp_pipeline_pm_power(source, sink_use);
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 46da365..f972de9 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -978,9 +978,6 @@ static int rc_dev_uevent(struct device *device, struct 
kobj_uevent_env *env)
 {
        struct rc_dev *dev = to_rc_dev(device);
 
-       if (!dev || !dev->input_dev)
-               return -ENODEV;
-
        if (dev->rc_map.name)
                ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name);
        if (dev->driver_name)
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 666d8c7..033d03c 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -329,8 +329,10 @@ EXPORT_SYMBOL(mmc_start_bkops);
  */
 static void mmc_wait_data_done(struct mmc_request *mrq)
 {
-       mrq->host->context_info.is_done_rcv = true;
-       wake_up_interruptible(&mrq->host->context_info.wait);
+       struct mmc_context_info *context_info = &mrq->host->context_info;
+
+       context_info->is_done_rcv = true;
+       wake_up_interruptible(&context_info->wait);
 }
 
 static void mmc_wait_done(struct mmc_request *mrq)
diff --git a/drivers/net/ethernet/broadcom/tg3.c 
b/drivers/net/ethernet/broadcom/tg3.c
index a2b0e6a..91643f7 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -10657,7 +10657,7 @@ static ssize_t tg3_show_temp(struct device *dev,
        tg3_ape_scratchpad_read(tp, &temperature, attr->index,
                                sizeof(temperature));
        spin_unlock_bh(&tp->lock);
-       return sprintf(buf, "%u\n", temperature);
+       return sprintf(buf, "%u\n", temperature * 1000);
 }
 
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 
b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 93cd505..a35d1de 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -314,6 +314,8 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
        {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
        {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+       {RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/
+       {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
        {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
        {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
        {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
diff --git a/drivers/of/address.c b/drivers/of/address.c
index 005c657..9eae613 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -704,10 +704,10 @@ struct device_node 
*of_find_matching_node_by_address(struct device_node *from,
        struct resource res;
 
        while (dn) {
-               if (of_address_to_resource(dn, 0, &res))
-                       continue;
-               if (res.start == base_address)
+               if (!of_address_to_resource(dn, 0, &res) &&
+                   res.start == base_address)
                        return dn;
+
                dn = of_find_matching_node(dn, matches);
        }
 
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index 0857ca9..6bc9b12 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -359,6 +359,56 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = {
        .release = pci_vpd_pci22_release,
 };
 
+static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
+                              void *arg)
+{
+       struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
+       ssize_t ret;
+
+       if (!tdev)
+               return -ENODEV;
+
+       ret = pci_read_vpd(tdev, pos, count, arg);
+       pci_dev_put(tdev);
+       return ret;
+}
+
+static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count,
+                               const void *arg)
+{
+       struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
+       ssize_t ret;
+
+       if (!tdev)
+               return -ENODEV;
+
+       ret = pci_write_vpd(tdev, pos, count, arg);
+       pci_dev_put(tdev);
+       return ret;
+}
+
+static const struct pci_vpd_ops pci_vpd_f0_ops = {
+       .read = pci_vpd_f0_read,
+       .write = pci_vpd_f0_write,
+       .release = pci_vpd_pci22_release,
+};
+
+static int pci_vpd_f0_dev_check(struct pci_dev *dev)
+{
+       struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
+       int ret = 0;
+
+       if (!tdev)
+               return -ENODEV;
+       if (!tdev->vpd || !tdev->multifunction ||
+           dev->class != tdev->class || dev->vendor != tdev->vendor ||
+           dev->device != tdev->device)
+               ret = -ENODEV;
+
+       pci_dev_put(tdev);
+       return ret;
+}
+
 int pci_vpd_pci22_init(struct pci_dev *dev)
 {
        struct pci_vpd_pci22 *vpd;
@@ -367,12 +417,21 @@ int pci_vpd_pci22_init(struct pci_dev *dev)
        cap = pci_find_capability(dev, PCI_CAP_ID_VPD);
        if (!cap)
                return -ENODEV;
+       if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) {
+               int ret = pci_vpd_f0_dev_check(dev);
+
+               if (ret)
+                       return ret;
+       }
        vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC);
        if (!vpd)
                return -ENOMEM;
 
        vpd->base.len = PCI_VPD_PCI22_SIZE;
-       vpd->base.ops = &pci_vpd_pci22_ops;
+       if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0)
+               vpd->base.ops = &pci_vpd_f0_ops;
+       else
+               vpd->base.ops = &pci_vpd_pci22_ops;
        mutex_init(&vpd->lock);
        vpd->cap = cap;
        vpd->busy = false;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c9564d4a..7e6cdb2d 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1878,6 +1878,15 @@ static void quirk_netmos(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID,
                         PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos);
 
+static void quirk_f0_vpd_link(struct pci_dev *dev)
+{
+       if (!dev->multifunction || !PCI_FUNC(dev->devfn))
+               return;
+       dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
+}
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
+                             PCI_CLASS_NETWORK_ETHERNET, 8, quirk_f0_vpd_link);
+
 static void quirk_e100_interrupt(struct pci_dev *dev)
 {
        u16 command, pmcsr;
@@ -2823,12 +2832,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, 
vtd_mask_spec_errors);
 
 static void fixup_ti816x_class(struct pci_dev *dev)
 {
+       u32 class = dev->class;
+
        /* TI 816x devices do not have class code set when in PCIe boot mode */
-       dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
-       dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
+       dev->class = PCI_CLASS_MULTIMEDIA_VIDEO << 8;
+       dev_info(&dev->dev, "PCI class overridden (%#08x -> %#08x)\n",
+                class, dev->class);
 }
 DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_TI, 0xb800,
-                                PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class);
+                             PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class);
 
 /* Some PCIe devices do not work reliably with the claimed maximum
  * payload size supported.
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index c6dcbe6..790f716 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -2025,8 +2025,17 @@ int scsi_error_handler(void *data)
         * We never actually get interrupted because kthread_run
         * disables signal delivery for the created thread.
         */
-       while (!kthread_should_stop()) {
+       while (true) {
+               /*
+                * The sequence in kthread_stop() sets the stop flag first
+                * then wakes the process.  To avoid missed wakeups, the task
+                * should always be in a non running state before the stop
+                * flag is checked
+                */
                set_current_state(TASK_INTERRUPTIBLE);
+               if (kthread_should_stop())
+                       break;
+
                if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) 
||
                    shost->host_failed != shost->host_busy) {
                        SCSI_LOG_ERROR_RECOVERY(1,
diff --git a/drivers/staging/comedi/drivers/adl_pci7x3x.c 
b/drivers/staging/comedi/drivers/adl_pci7x3x.c
index 5617f5c..deceaa0 100644
--- a/drivers/staging/comedi/drivers/adl_pci7x3x.c
+++ b/drivers/staging/comedi/drivers/adl_pci7x3x.c
@@ -113,8 +113,20 @@ static int adl_pci7x3x_do_insn_bits(struct comedi_device 
*dev,
 {
        unsigned long reg = (unsigned long)s->private;
 
-       if (comedi_dio_update_state(s, data))
-               outl(s->state, dev->iobase + reg);
+       if (comedi_dio_update_state(s, data)) {
+               unsigned int val = s->state;
+
+               if (s->n_chan == 16) {
+                       /*
+                        * It seems the PCI-7230 needs the 16-bit DO state
+                        * to be shifted left by 16 bits before being written
+                        * to the 32-bit register.  Set the value in both
+                        * halves of the register to be sure.
+                        */
+                       val |= val << 16;
+               }
+               outl(val, dev->iobase + reg);
+       }
 
        data[1] = s->state;
 
diff --git a/drivers/tty/serial/8250/8250_pci.c 
b/drivers/tty/serial/8250/8250_pci.c
index 5ac6391..1339da4 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1772,6 +1772,12 @@ pci_wch_ch353_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_SUNIX_1999       0x1999
 
 
+#define PCI_VENDOR_ID_PERICOM                  0x12D8
+#define PCI_DEVICE_ID_PERICOM_PI7C9X7951       0x7951
+#define PCI_DEVICE_ID_PERICOM_PI7C9X7952       0x7952
+#define PCI_DEVICE_ID_PERICOM_PI7C9X7954       0x7954
+#define PCI_DEVICE_ID_PERICOM_PI7C9X7958       0x7958
+
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584        0x1584
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588        0x1588
@@ -2051,27 +2057,12 @@ static struct pci_serial_quirk pci_serial_quirks[] 
__refdata = {
         * Pericom
         */
        {
-               .vendor         = 0x12d8,
-               .device         = 0x7952,
-               .subvendor      = PCI_ANY_ID,
-               .subdevice      = PCI_ANY_ID,
-               .setup          = pci_pericom_setup,
-       },
-       {
-               .vendor         = 0x12d8,
-               .device         = 0x7954,
-               .subvendor      = PCI_ANY_ID,
-               .subdevice      = PCI_ANY_ID,
-               .setup          = pci_pericom_setup,
-       },
-       {
-               .vendor         = 0x12d8,
-               .device         = 0x7958,
-               .subvendor      = PCI_ANY_ID,
-               .subdevice      = PCI_ANY_ID,
-               .setup          = pci_pericom_setup,
+               .vendor         = PCI_VENDOR_ID_PERICOM,
+               .device         = PCI_ANY_ID,
+               .subvendor      = PCI_ANY_ID,
+               .subdevice      = PCI_ANY_ID,
+               .setup          = pci_pericom_setup,
        },
-
        /*
         * PLX
         */
@@ -2725,6 +2716,10 @@ enum pci_board_num_t {
        pbn_fintek_4,
        pbn_fintek_8,
        pbn_fintek_12,
+       pbn_pericom_PI7C9X7951,
+       pbn_pericom_PI7C9X7952,
+       pbn_pericom_PI7C9X7954,
+       pbn_pericom_PI7C9X7958,
 };
 
 /*
@@ -3506,6 +3501,33 @@ static struct pciserial_board pci_boards[] = {
                .base_baud      = 115200,
                .first_offset   = 0x40,
        },
+       /*
+        * Pericom PI7C9X795[1248] Uno/Dual/Quad/Octal UART
+        */
+       [pbn_pericom_PI7C9X7951] = {
+               .flags          = FL_BASE0,
+               .num_ports      = 1,
+               .base_baud      = 921600,
+               .uart_offset    = 0x8,
+       },
+       [pbn_pericom_PI7C9X7952] = {
+               .flags          = FL_BASE0,
+               .num_ports      = 2,
+               .base_baud      = 921600,
+               .uart_offset    = 0x8,
+       },
+       [pbn_pericom_PI7C9X7954] = {
+               .flags          = FL_BASE0,
+               .num_ports      = 4,
+               .base_baud      = 921600,
+               .uart_offset    = 0x8,
+       },
+       [pbn_pericom_PI7C9X7958] = {
+               .flags          = FL_BASE0,
+               .num_ports      = 8,
+               .base_baud      = 921600,
+               .uart_offset    = 0x8,
+       },
 };
 
 static const struct pci_device_id blacklist[] = {
@@ -4747,6 +4769,25 @@ static struct pci_device_id serial_pci_tbl[] = {
                0, pbn_exar_XR17V358 },
 
        /*
+        * Pericom PI7C9X795[1248] Uno/Dual/Quad/Octal UART
+        */
+       {   PCI_VENDOR_ID_PERICOM, PCI_DEVICE_ID_PERICOM_PI7C9X7951,
+               PCI_ANY_ID, PCI_ANY_ID,
+               0,
+               0, pbn_pericom_PI7C9X7951 },
+       {   PCI_VENDOR_ID_PERICOM, PCI_DEVICE_ID_PERICOM_PI7C9X7952,
+               PCI_ANY_ID, PCI_ANY_ID,
+               0,
+               0, pbn_pericom_PI7C9X7952 },
+       {   PCI_VENDOR_ID_PERICOM, PCI_DEVICE_ID_PERICOM_PI7C9X7954,
+               PCI_ANY_ID, PCI_ANY_ID,
+               0,
+               0, pbn_pericom_PI7C9X7954 },
+       {   PCI_VENDOR_ID_PERICOM, PCI_DEVICE_ID_PERICOM_PI7C9X7958,
+               PCI_ANY_ID, PCI_ANY_ID,
+               0,
+               0, pbn_pericom_PI7C9X7958 },
+       /*
         * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
         */
        {       PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560,
diff --git a/drivers/tty/serial/8250/8250_pnp.c 
b/drivers/tty/serial/8250/8250_pnp.c
index 35d9ab9..91b1420 100644
--- a/drivers/tty/serial/8250/8250_pnp.c
+++ b/drivers/tty/serial/8250/8250_pnp.c
@@ -365,6 +365,11 @@ static const struct pnp_device_id pnp_dev_table[] = {
        /* Winbond CIR port, should not be probed. We should keep track
           of it to prevent the legacy serial driver from probing it */
        {       "WEC1022",              CIR_PORT        },
+       /*
+        * SMSC IrCC SIR/FIR port, should not be probed by serial driver
+        * as well so its own driver can bind to it.
+        */
+       {       "SMCF010",              CIR_PORT        },
        {       "",                     0       }
 };
 
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index bcefce0..312bc05 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                unsigned maxp = ep0->endpoint.maxpacket;
 
                transfer_size += (maxp - (transfer_size % maxp));
+
+               /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
+               if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
+                       transfer_size = DWC3_EP0_BOUNCE_SIZE;
+
                transferred = min_t(u32, ur->length,
                                transfer_size - length);
                memcpy(ur->buf, dwc->ep0_bounce, transferred);
@@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                        return;
                }
 
-               WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
-
                maxpacket = dep->endpoint.maxpacket;
                transfer_size = roundup(req->request.length, maxpacket);
 
+               if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
+                       dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
+                       transfer_size = DWC3_EP0_BOUNCE_SIZE;
+               }
+
                dwc->ep0_bounced = true;
 
                /*
diff --git a/drivers/usb/gadget/m66592-udc.c b/drivers/usb/gadget/m66592-udc.c
index d5f050d..aba93b6 100644
--- a/drivers/usb/gadget/m66592-udc.c
+++ b/drivers/usb/gadget/m66592-udc.c
@@ -1052,7 +1052,7 @@ static void set_feature(struct m66592 *m66592, struct 
usb_ctrlrequest *ctrl)
                                tmp = m66592_read(m66592, M66592_INTSTS0) &
                                                                M66592_CTSQ;
                                udelay(1);
-                       } while (tmp != M66592_CS_IDST || timeout-- > 0);
+                       } while (tmp != M66592_CS_IDST && timeout-- > 0);
 
                        if (tmp == M66592_CS_IDST)
                                m66592_bset(m66592,
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index df1fdca..17d5810 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -133,6 +133,15 @@ static int usb_hcd_fsl_probe(const struct hc_driver 
*driver,
        if (pdata->have_sysif_regs && pdata->controller_ver < FSL_USB_VER_1_6)
                setbits32(hcd->regs + FSL_SOC_USB_CTRL, 0x4);
 
+       /*
+        * Enable UTMI phy and program PTS field in UTMI mode before asserting
+        * controller reset for USB Controller version 2.5
+        */
+       if (pdata->has_fsl_erratum_a007792) {
+               writel_be(CTRL_UTMI_PHY_EN, hcd->regs + FSL_SOC_USB_CTRL);
+               writel(PORT_PTS_UTMI, hcd->regs + FSL_SOC_USB_PORTSC1);
+       }
+
        /* Don't need to set host mode here. It will be done by tdi_reset() */
 
        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
@@ -302,6 +311,10 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
                out_be32(non_ehci + FSL_SOC_USB_SNOOP2, 0x80000000 | 
SNOOP_SIZE_2GB);
        }
 
+       /* Deal with USB erratum A-005275 */
+       if (pdata->has_fsl_erratum_a005275 == 1)
+               ehci->has_fsl_hs_errata = 1;
+
        if ((pdata->operating_mode == FSL_USB2_DR_HOST) ||
                        (pdata->operating_mode == FSL_USB2_DR_OTG))
                if (ehci_fsl_setup_phy(hcd, pdata->phy_mode, 0))
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 68a06b2..b05d489 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1229,6 +1229,13 @@ static int ehci_hub_control (
                                 */
                                ehci->reset_done [wIndex] = jiffies
                                                + msecs_to_jiffies (50);
+
+                               /*
+                                * Force full-speed connect for FSL high-speed
+                                * erratum; disable HS Chirp by setting PFSC bit
+                                */
+                               if (ehci_has_fsl_hs_errata(ehci))
+                                       temp |= (1 << PORTSC_FSL_PFSC);
                        }
                        ehci_writel(ehci, temp, status_reg);
                        break;
diff --git a/drivers/usb/host/ehci-sysfs.c b/drivers/usb/host/ehci-sysfs.c
index f6459df..94054da 100644
--- a/drivers/usb/host/ehci-sysfs.c
+++ b/drivers/usb/host/ehci-sysfs.c
@@ -29,7 +29,7 @@ static ssize_t show_companion(struct device *dev,
        int                     count = PAGE_SIZE;
        char                    *ptr = buf;
 
-       ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
+       ehci = hcd_to_ehci(dev_get_drvdata(dev));
        nports = HCS_N_PORTS(ehci->hcs_params);
 
        for (index = 0; index < nports; ++index) {
@@ -54,7 +54,7 @@ static ssize_t store_companion(struct device *dev,
        struct ehci_hcd         *ehci;
        int                     portnum, new_owner;
 
-       ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
+       ehci = hcd_to_ehci(dev_get_drvdata(dev));
        new_owner = PORT_OWNER;         /* Owned by companion */
        if (sscanf(buf, "%d", &portnum) != 1)
                return -EINVAL;
@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(struct device *dev,
        struct ehci_hcd         *ehci;
        int                     n;
 
-       ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
+       ehci = hcd_to_ehci(dev_get_drvdata(dev));
        n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max);
        return n;
 }
@@ -101,7 +101,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
        unsigned long           flags;
        ssize_t                 ret;
 
-       ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
+       ehci = hcd_to_ehci(dev_get_drvdata(dev));
        if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
                return -EINVAL;
 
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index bf4555a..4c40c41 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -215,6 +215,7 @@ struct ehci_hcd {                   /* one per controller */
        /* SILICON QUIRKS */
        unsigned                no_selective_suspend:1;
        unsigned                has_fsl_port_bug:1; /* FreeScale */
+       unsigned                has_fsl_hs_errata:1;    /* Freescale HS quirk */
        unsigned                big_endian_mmio:1;
        unsigned                big_endian_desc:1;
        unsigned                big_endian_capbase:1;
@@ -686,6 +687,17 @@ ehci_port_speed(struct ehci_hcd *ehci, unsigned int portsc)
 #define        ehci_has_fsl_portno_bug(e)              (0)
 #endif
 
+#define PORTSC_FSL_PFSC        24      /* Port Force Full-Speed Connect */
+
+#if defined(CONFIG_PPC_85xx)
+/* Some Freescale processors have an erratum (USB A-005275) in which
+ * incoming packets get corrupted in HS mode
+ */
+#define ehci_has_fsl_hs_errata(e)      ((e)->has_fsl_hs_errata)
+#else
+#define ehci_has_fsl_hs_errata(e)      (0)
+#endif
+
 /*
  * While most USB host controllers implement their registers in
  * little-endian format, a minority (celleb companion chip) implement
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index abd5050..8fedddc 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -206,6 +206,16 @@ static int fsl_usb2_mph_dr_of_probe(struct platform_device 
*ofdev)
        pdata->phy_mode = determine_usb_phy(prop);
        pdata->controller_ver = usb_get_ver_info(np);
 
+       /* Activate Erratum by reading property in device tree */
+       if (of_get_property(np, "fsl,usb-erratum-a007792", NULL))
+               pdata->has_fsl_erratum_a007792 = 1;
+       else
+               pdata->has_fsl_erratum_a007792 = 0;
+       if (of_get_property(np, "fsl,usb-erratum-a005275", NULL))
+               pdata->has_fsl_erratum_a005275 = 1;
+       else
+               pdata->has_fsl_erratum_a005275 = 0;
+
        if (pdata->have_sysif_regs) {
                if (pdata->controller_ver < 0) {
                        dev_warn(&ofdev->dev, "Could not get controller 
version\n");
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d6f486e..50505a8 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -619,6 +619,10 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+       { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
+       { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
+       { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) },
+       { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) },
        /*
         * ELV devices:
         */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h 
b/drivers/usb/serial/ftdi_sio_ids.h
index 792e054..2943b97 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -568,6 +568,14 @@
  */
 #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
 
+/*
+ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID)
+ */
+#define FTDI_CUSTOMWARE_MINIPLEX_PID   0xfd48  /* MiniPlex first generation 
NMEA Multiplexer */
+#define FTDI_CUSTOMWARE_MINIPLEX2_PID  0xfd49  /* MiniPlex-USB and MiniPlex-2 
series */
+#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID        0xfd4a  /* MiniPlex-2Wi */
+#define FTDI_CUSTOMWARE_MINIPLEX3_PID  0xfd4b  /* MiniPlex-3 series */
+
 
 /********************************/
 /** third-party VID/PID combos **/
diff --git a/drivers/usb/serial/symbolserial.c 
b/drivers/usb/serial/symbolserial.c
index 9b16489..1e2d86d 100644
--- a/drivers/usb/serial/symbolserial.c
+++ b/drivers/usb/serial/symbolserial.c
@@ -97,7 +97,7 @@ exit:
 
 static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
-       struct symbol_private *priv = usb_get_serial_data(port->serial);
+       struct symbol_private *priv = usb_get_serial_port_data(port);
        unsigned long flags;
        int result = 0;
 
@@ -123,7 +123,7 @@ static void symbol_close(struct usb_serial_port *port)
 static void symbol_throttle(struct tty_struct *tty)
 {
        struct usb_serial_port *port = tty->driver_data;
-       struct symbol_private *priv = usb_get_serial_data(port->serial);
+       struct symbol_private *priv = usb_get_serial_port_data(port);
 
        spin_lock_irq(&priv->lock);
        priv->throttled = true;
@@ -133,7 +133,7 @@ static void symbol_throttle(struct tty_struct *tty)
 static void symbol_unthrottle(struct tty_struct *tty)
 {
        struct usb_serial_port *port = tty->driver_data;
-       struct symbol_private *priv = usb_get_serial_data(port->serial);
+       struct symbol_private *priv = usb_get_serial_port_data(port);
        int result;
        bool was_throttled;
 
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index cc5a430..69fec1a 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -81,6 +81,8 @@ static int  whiteheat_firmware_download(struct usb_serial 
*serial,
 static int  whiteheat_firmware_attach(struct usb_serial *serial);
 
 /* function prototypes for the Connect Tech WhiteHEAT serial converter */
+static int whiteheat_probe(struct usb_serial *serial,
+                               const struct usb_device_id *id);
 static int  whiteheat_attach(struct usb_serial *serial);
 static void whiteheat_release(struct usb_serial *serial);
 static int  whiteheat_port_probe(struct usb_serial_port *port);
@@ -117,6 +119,7 @@ static struct usb_serial_driver whiteheat_device = {
        .description =          "Connect Tech - WhiteHEAT",
        .id_table =             id_table_std,
        .num_ports =            4,
+       .probe =                whiteheat_probe,
        .attach =               whiteheat_attach,
        .release =              whiteheat_release,
        .port_probe =           whiteheat_port_probe,
@@ -218,6 +221,34 @@ static int whiteheat_firmware_attach(struct usb_serial 
*serial)
 /*****************************************************************************
  * Connect Tech's White Heat serial driver functions
  *****************************************************************************/
+
+static int whiteheat_probe(struct usb_serial *serial,
+                               const struct usb_device_id *id)
+{
+       struct usb_host_interface *iface_desc;
+       struct usb_endpoint_descriptor *endpoint;
+       size_t num_bulk_in = 0;
+       size_t num_bulk_out = 0;
+       size_t min_num_bulk;
+       unsigned int i;
+
+       iface_desc = serial->interface->cur_altsetting;
+
+       for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
+               endpoint = &iface_desc->endpoint[i].desc;
+               if (usb_endpoint_is_bulk_in(endpoint))
+                       ++num_bulk_in;
+               if (usb_endpoint_is_bulk_out(endpoint))
+                       ++num_bulk_out;
+       }
+
+       min_num_bulk = COMMAND_PORT + 1;
+       if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
+               return -ENODEV;
+
+       return 0;
+}
+
 static int whiteheat_attach(struct usb_serial *serial)
 {
        struct usb_serial_port *command_port;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index b329f96..b9d30dc 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1712,8 +1712,11 @@ int btrfs_commit_transaction(struct btrfs_trans_handle 
*trans,
                        spin_unlock(&root->fs_info->trans_lock);
 
                        wait_for_commit(root, prev_trans);
+                       ret = prev_trans->aborted;
 
                        btrfs_put_transaction(prev_trans);
+                       if (ret)
+                               goto cleanup_transaction;
                } else {
                        spin_unlock(&root->fs_info->trans_lock);
                }
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 6a0951e..c495508 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -460,7 +460,8 @@ static int ceph_show_options(struct seq_file *m, struct 
dentry *root)
        if (fsopt->max_readdir_bytes != CEPH_MAX_READDIR_BYTES_DEFAULT)
                seq_printf(m, ",readdir_max_bytes=%d", 
fsopt->max_readdir_bytes);
        if (strcmp(fsopt->snapdir_name, CEPH_SNAPDIRNAME_DEFAULT))
-               seq_printf(m, ",snapdirname=%s", fsopt->snapdir_name);
+               seq_show_option(m, "snapdirname", fsopt->snapdir_name);
+
        return 0;
 }
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 7c6b73c..c90d4bd 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -390,17 +390,17 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
        struct sockaddr *srcaddr;
        srcaddr = (struct sockaddr *)&tcon->ses->server->srcaddr;
 
-       seq_printf(s, ",vers=%s", tcon->ses->server->vals->version_string);
+       seq_show_option(s, "vers", tcon->ses->server->vals->version_string);
        cifs_show_security(s, tcon->ses);
        cifs_show_cache_flavor(s, cifs_sb);
 
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
                seq_printf(s, ",multiuser");
        else if (tcon->ses->user_name)
-               seq_printf(s, ",username=%s", tcon->ses->user_name);
+               seq_show_option(s, "username", tcon->ses->user_name);
 
        if (tcon->ses->domainName)
-               seq_printf(s, ",domain=%s", tcon->ses->domainName);
+               seq_show_option(s, "domain", tcon->ses->domainName);
 
        if (srcaddr->sa_family != AF_UNSPEC) {
                struct sockaddr_in *saddr4;
diff --git a/fs/coredump.c b/fs/coredump.c
index 59009ac..c28bcd2 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -499,10 +499,10 @@ void do_coredump(const siginfo_t *siginfo)
        const struct cred *old_cred;
        struct cred *cred;
        int retval = 0;
-       int flag = 0;
        int ispipe;
        struct files_struct *displaced;
-       bool need_nonrelative = false;
+       /* require nonrelative corefile path and be extra careful */
+       bool need_suid_safe = false;
        bool core_dumped = false;
        static atomic_t core_dump_count = ATOMIC_INIT(0);
        struct coredump_params cprm = {
@@ -536,9 +536,8 @@ void do_coredump(const siginfo_t *siginfo)
         */
        if (__get_dumpable(cprm.mm_flags) == SUID_DUMP_ROOT) {
                /* Setuid core dump mode */
-               flag = O_EXCL;          /* Stop rewrite attacks */
                cred->fsuid = GLOBAL_ROOT_UID;  /* Dump root private */
-               need_nonrelative = true;
+               need_suid_safe = true;
        }
 
        retval = coredump_wait(siginfo->si_signo, &core_state);
@@ -619,7 +618,7 @@ void do_coredump(const siginfo_t *siginfo)
                if (cprm.limit < binfmt->min_coredump)
                        goto fail_unlock;
 
-               if (need_nonrelative && cn.corename[0] != '/') {
+               if (need_suid_safe && cn.corename[0] != '/') {
                        printk(KERN_WARNING "Pid %d(%s) can only dump core "\
                                "to fully qualified path!\n",
                                task_tgid_vnr(current), current->comm);
@@ -627,8 +626,35 @@ void do_coredump(const siginfo_t *siginfo)
                        goto fail_unlock;
                }
 
+               /*
+                * Unlink the file if it exists unless this is a SUID
+                * binary - in that case, we're running around with root
+                * privs and don't want to unlink another user's coredump.
+                */
+               if (!need_suid_safe) {
+                       mm_segment_t old_fs;
+
+                       old_fs = get_fs();
+                       set_fs(KERNEL_DS);
+                       /*
+                        * If it doesn't exist, that's fine. If there's some
+                        * other problem, we'll catch it at the filp_open().
+                        */
+                       (void) sys_unlink((const char __user *)cn.corename);
+                       set_fs(old_fs);
+               }
+
+               /*
+                * There is a race between unlinking and creating the
+                * file, but if that causes an EEXIST here, that's
+                * fine - another process raced with us while creating
+                * the corefile, and the other process won. To userspace,
+                * what matters is that at least one of the two processes
+                * writes its coredump successfully, not which one.
+                */
                cprm.file = filp_open(cn.corename,
-                                O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
+                                O_CREAT | 2 | O_NOFOLLOW |
+                                O_LARGEFILE | O_EXCL,
                                 0600);
                if (IS_ERR(cprm.file))
                        goto fail_unlock;
diff --git a/fs/dcache.c b/fs/dcache.c
index 09b4a3e..5769de8 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2903,6 +2903,13 @@ restart:
 
                if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
                        struct mount *parent = ACCESS_ONCE(mnt->mnt_parent);
+                       /* Escaped? */
+                       if (dentry != vfsmnt->mnt_root) {
+                               bptr = *buffer;
+                               blen = *buflen;
+                               error = 3;
+                               break;
+                       }
                        /* Global root? */
                        if (mnt != parent) {
                                dentry = ACCESS_ONCE(mnt->mnt_mountpoint);
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 4000f6b..c7703c0 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -45,20 +45,20 @@
 static int ecryptfs_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-       int rc;
-
-       if (!(lower_dentry->d_flags & DCACHE_OP_REVALIDATE))
-               return 1;
+       int rc = 1;
 
        if (flags & LOOKUP_RCU)
                return -ECHILD;
 
-       rc = lower_dentry->d_op->d_revalidate(lower_dentry, flags);
+       if (lower_dentry->d_flags & DCACHE_OP_REVALIDATE)
+               rc = lower_dentry->d_op->d_revalidate(lower_dentry, flags);
+
        if (dentry->d_inode) {
-               struct inode *lower_inode =
-                       ecryptfs_inode_to_lower(dentry->d_inode);
+               struct inode *inode = dentry->d_inode;
 
-               fsstack_copy_attr_all(dentry->d_inode, lower_inode);
+               fsstack_copy_attr_all(inode, ecryptfs_inode_to_lower(inode));
+               if (!inode->i_nlink)
+                       return 0;
        }
        return rc;
 }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index a07af5b..c261beb 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1744,10 +1744,10 @@ static inline void ext4_show_quota_options(struct 
seq_file *seq,
        }
 
        if (sbi->s_qf_names[USRQUOTA])
-               seq_printf(seq, ",usrjquota=%s", sbi->s_qf_names[USRQUOTA]);
+               seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
 
        if (sbi->s_qf_names[GRPQUOTA])
-               seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
+               seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
 #endif
 }
 
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 35da5b1..b05f395 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1258,11 +1258,11 @@ static int gfs2_show_options(struct seq_file *s, struct 
dentry *root)
        if (is_ancestor(root, sdp->sd_master_dir))
                seq_printf(s, ",meta");
        if (args->ar_lockproto[0])
-               seq_printf(s, ",lockproto=%s", args->ar_lockproto);
+               seq_show_option(s, "lockproto", args->ar_lockproto);
        if (args->ar_locktable[0])
-               seq_printf(s, ",locktable=%s", args->ar_locktable);
+               seq_show_option(s, "locktable", args->ar_locktable);
        if (args->ar_hostdata[0])
-               seq_printf(s, ",hostdata=%s", args->ar_hostdata);
+               seq_show_option(s, "hostdata", args->ar_hostdata);
        if (args->ar_spectator)
                seq_printf(s, ",spectator");
        if (args->ar_localflocks)
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index d3fa6bd..221719e 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -288,7 +288,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct 
hfs_btree *tree, u32 cnid)
                        page_cache_release(page);
                        goto fail;
                }
-               page_cache_release(page);
                node->page[i] = page;
        }
 
@@ -398,11 +397,11 @@ node_error:
 
 void hfs_bnode_free(struct hfs_bnode *node)
 {
-       //int i;
+       int i;
 
-       //for (i = 0; i < node->tree->pages_per_bnode; i++)
-       //      if (node->page[i])
-       //              page_cache_release(node->page[i]);
+       for (i = 0; i < node->tree->pages_per_bnode; i++)
+               if (node->page[i])
+                       page_cache_release(node->page[i]);
        kfree(node);
 }
 
diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
index 9f4ee7f..6fc766d 100644
--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -131,13 +131,16 @@ skip:
        hfs_bnode_write(node, entry, data_off + key_len, entry_len);
        hfs_bnode_dump(node);
 
-       if (new_node) {
-               /* update parent key if we inserted a key
-                * at the start of the first node
-                */
-               if (!rec && new_node != node)
-                       hfs_brec_update_parent(fd);
+       /*
+        * update parent key if we inserted a key
+        * at the start of the node and it is not the new node
+        */
+       if (!rec && new_node != node) {
+               hfs_bnode_read_key(node, fd->search_key, data_off + size);
+               hfs_brec_update_parent(fd);
+       }
 
+       if (new_node) {
                hfs_bnode_put(fd->bnode);
                if (!new_node->parent) {
                        hfs_btree_inc_height(tree);
@@ -166,9 +169,6 @@ skip:
                goto again;
        }
 
-       if (!rec)
-               hfs_brec_update_parent(fd);
-
        return 0;
 }
 
@@ -366,6 +366,8 @@ again:
        if (IS_ERR(parent))
                return PTR_ERR(parent);
        __hfs_brec_find(parent, fd);
+       if (fd->record < 0)
+               return -ENOENT;
        hfs_bnode_dump(parent);
        rec = fd->record;
 
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 2d2039e..52cd187 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -134,9 +134,9 @@ static int hfs_show_options(struct seq_file *seq, struct 
dentry *root)
        struct hfs_sb_info *sbi = HFS_SB(root->d_sb);
 
        if (sbi->s_creator != cpu_to_be32(0x3f3f3f3f))
-               seq_printf(seq, ",creator=%.4s", (char *)&sbi->s_creator);
+               seq_show_option_n(seq, "creator", (char *)&sbi->s_creator, 4);
        if (sbi->s_type != cpu_to_be32(0x3f3f3f3f))
-               seq_printf(seq, ",type=%.4s", (char *)&sbi->s_type);
+               seq_show_option_n(seq, "type", (char *)&sbi->s_type, 4);
        seq_printf(seq, ",uid=%u,gid=%u",
                        from_kuid_munged(&init_user_ns, sbi->s_uid),
                        from_kgid_munged(&init_user_ns, sbi->s_gid));
diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index 11c8602..bedfe5f 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -456,7 +456,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct 
hfs_btree *tree, u32 cnid)
                        page_cache_release(page);
                        goto fail;
                }
-               page_cache_release(page);
                node->page[i] = page;
        }
 
@@ -568,13 +567,11 @@ node_error:
 
 void hfs_bnode_free(struct hfs_bnode *node)
 {
-#if 0
        int i;
 
        for (i = 0; i < node->tree->pages_per_bnode; i++)
                if (node->page[i])
                        page_cache_release(node->page[i]);
-#endif
        kfree(node);
 }
 
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 968eab5..beaae4e 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -219,9 +219,9 @@ int hfsplus_show_options(struct seq_file *seq, struct 
dentry *root)
        struct hfsplus_sb_info *sbi = HFSPLUS_SB(root->d_sb);
 
        if (sbi->creator != HFSPLUS_DEF_CR_TYPE)
-               seq_printf(seq, ",creator=%.4s", (char *)&sbi->creator);
+               seq_show_option_n(seq, "creator", (char *)&sbi->creator, 4);
        if (sbi->type != HFSPLUS_DEF_CR_TYPE)
-               seq_printf(seq, ",type=%.4s", (char *)&sbi->type);
+               seq_show_option_n(seq, "type", (char *)&sbi->type, 4);
        seq_printf(seq, ",umask=%o,uid=%u,gid=%u", sbi->umask,
                        from_kuid_munged(&init_user_ns, sbi->uid),
                        from_kgid_munged(&init_user_ns, sbi->gid));
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index db23ce1..5d2585a 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -255,7 +255,7 @@ static int hostfs_show_options(struct seq_file *seq, struct 
dentry *root)
        size_t offset = strlen(root_ino) + 1;
 
        if (strlen(root_path) > offset)
-               seq_printf(seq, ",%s", root_path + offset);
+               seq_show_option(seq, root_path + offset, NULL);
 
        return 0;
 }
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 1b39afd..5f60bb2 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -8,6 +8,17 @@
 #include <linux/sched.h>
 #include "hpfs_fn.h"
 
+static void hpfs_update_directory_times(struct inode *dir)
+{
+       time_t t = get_seconds();
+       if (t == dir->i_mtime.tv_sec &&
+           t == dir->i_ctime.tv_sec)
+               return;
+       dir->i_mtime.tv_sec = dir->i_ctime.tv_sec = t;
+       dir->i_mtime.tv_nsec = dir->i_ctime.tv_nsec = 0;
+       hpfs_write_inode_nolock(dir);
+}
+
 static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
        const unsigned char *name = dentry->d_name.name;
@@ -99,6 +110,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry 
*dentry, umode_t mode)
                result->i_mode = mode | S_IFDIR;
                hpfs_write_inode_nolock(result);
        }
+       hpfs_update_directory_times(dir);
        d_instantiate(dentry, result);
        hpfs_unlock(dir->i_sb);
        return 0;
@@ -187,6 +199,7 @@ static int hpfs_create(struct inode *dir, struct dentry 
*dentry, umode_t mode, b
                result->i_mode = mode | S_IFREG;
                hpfs_write_inode_nolock(result);
        }
+       hpfs_update_directory_times(dir);
        d_instantiate(dentry, result);
        hpfs_unlock(dir->i_sb);
        return 0;
@@ -262,6 +275,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry 
*dentry, umode_t mode, de
        insert_inode_hash(result);
 
        hpfs_write_inode_nolock(result);
+       hpfs_update_directory_times(dir);
        d_instantiate(dentry, result);
        brelse(bh);
        hpfs_unlock(dir->i_sb);
@@ -340,6 +354,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry 
*dentry, const char *sy
        insert_inode_hash(result);
 
        hpfs_write_inode_nolock(result);
+       hpfs_update_directory_times(dir);
        d_instantiate(dentry, result);
        hpfs_unlock(dir->i_sb);
        return 0;
@@ -423,6 +438,8 @@ again:
 out1:
        hpfs_brelse4(&qbh);
 out:
+       if (!err)
+               hpfs_update_directory_times(dir);
        hpfs_unlock(dir->i_sb);
        return err;
 }
@@ -477,6 +494,8 @@ static int hpfs_rmdir(struct inode *dir, struct dentry 
*dentry)
 out1:
        hpfs_brelse4(&qbh);
 out:
+       if (!err)
+               hpfs_update_directory_times(dir);
        hpfs_unlock(dir->i_sb);
        return err;
 }
@@ -595,7 +614,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry 
*old_dentry,
                goto end1;
        }
 
-       end:
+end:
        hpfs_i(i)->i_parent_dir = new_dir->i_ino;
        if (S_ISDIR(i->i_mode)) {
                inc_nlink(new_dir);
@@ -610,6 +629,10 @@ static int hpfs_rename(struct inode *old_dir, struct 
dentry *old_dentry,
                brelse(bh);
        }
 end1:
+       if (!err) {
+               hpfs_update_directory_times(old_dir);
+               hpfs_update_directory_times(new_dir);
+       }
        hpfs_unlock(i->i_sb);
        return err;
 }
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index b892355..d4c7e47 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -475,14 +475,15 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
  * journal_clean_one_cp_list
  *
  * Find all the written-back checkpoint buffers in the given list and
- * release them.
+ * release them. If 'destroy' is set, clean all buffers unconditionally.
  *
  * Called with the journal locked.
  * Called with j_list_lock held.
  * Returns number of buffers reaped (for debug)
  */
 
-static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
+static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy,
+                                    int *released)
 {
        struct journal_head *last_jh;
        struct journal_head *next_jh = jh;
@@ -496,7 +497,10 @@ static int journal_clean_one_cp_list(struct journal_head 
*jh, int *released)
        do {
                jh = next_jh;
                next_jh = jh->b_cpnext;
-               ret = __try_to_free_cp_buf(jh);
+               if (!destroy)
+                       ret = __try_to_free_cp_buf(jh);
+               else
+                       ret = __jbd2_journal_remove_checkpoint(jh) + 1;
                if (ret) {
                        freed++;
                        if (ret == 2) {
@@ -521,13 +525,14 @@ static int journal_clean_one_cp_list(struct journal_head 
*jh, int *released)
  * journal_clean_checkpoint_list
  *
  * Find all the written-back checkpoint buffers in the journal and release 
them.
+ * If 'destroy' is set, release all buffers unconditionally.
  *
  * Called with the journal locked.
  * Called with j_list_lock held.
  * Returns number of buffers reaped (for debug)
  */
 
-int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy)
 {
        transaction_t *transaction, *last_transaction, *next_transaction;
        int ret = 0;
@@ -543,7 +548,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
                transaction = next_transaction;
                next_transaction = transaction->t_cpnext;
                ret += journal_clean_one_cp_list(transaction->
-                               t_checkpoint_list, &released);
+                               t_checkpoint_list, destroy, &released);
                /*
                 * This function only frees up some memory if possible so we
                 * dont have an obligation to finish processing. Bail out if
@@ -559,7 +564,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
                 * we can possibly see not yet submitted buffers on io_list
                 */
                ret += journal_clean_one_cp_list(transaction->
-                               t_checkpoint_io_list, &released);
+                               t_checkpoint_io_list, destroy, &released);
                if (need_resched())
                        goto out;
        } while (transaction != last_transaction);
@@ -568,6 +573,28 @@ out:
 }
 
 /*
+ * Remove buffers from all checkpoint lists as journal is aborted and we just
+ * need to free memory
+ */
+void jbd2_journal_destroy_checkpoint(journal_t *journal)
+{
+       /*
+        * We loop because __jbd2_journal_clean_checkpoint_list() may abort
+        * early due to a need of rescheduling.
+        */
+       while (1) {
+               spin_lock(&journal->j_list_lock);
+               if (!journal->j_checkpoint_transactions) {
+                       spin_unlock(&journal->j_list_lock);
+                       break;
+               }
+               __jbd2_journal_clean_checkpoint_list(journal, true);
+               spin_unlock(&journal->j_list_lock);
+               cond_resched();
+       }
+}
+
+/*
  * journal_remove_checkpoint: called after a buffer has been committed
  * to disk (either by being write-back flushed to disk, or being
  * committed to the log).
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 9181c2b..4207cf2 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -510,7 +510,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         * frees some memory
         */
        spin_lock(&journal->j_list_lock);
-       __jbd2_journal_clean_checkpoint_list(journal);
+       __jbd2_journal_clean_checkpoint_list(journal, false);
        spin_unlock(&journal->j_list_lock);
 
        jbd_debug(3, "JBD2: commit phase 1\n");
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index e8d62d7..3b607a8 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1708,8 +1708,17 @@ int jbd2_journal_destroy(journal_t *journal)
        while (journal->j_checkpoint_transactions != NULL) {
                spin_unlock(&journal->j_list_lock);
                mutex_lock(&journal->j_checkpoint_mutex);
-               jbd2_log_do_checkpoint(journal);
+               err = jbd2_log_do_checkpoint(journal);
                mutex_unlock(&journal->j_checkpoint_mutex);
+               /*
+                * If checkpointing failed, just free the buffers to avoid
+                * looping forever
+                */
+               if (err) {
+                       jbd2_journal_destroy_checkpoint(journal);
+                       spin_lock(&journal->j_list_lock);
+                       break;
+               }
                spin_lock(&journal->j_list_lock);
        }
 
diff --git a/fs/namei.c b/fs/namei.c
index 5f6401d..3c87058 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -472,6 +472,24 @@ void path_put(const struct path *path)
 }
 EXPORT_SYMBOL(path_put);
 
+/**
+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
+ * @path: nameidate to verify
+ *
+ * Rename can sometimes move a file or directory outside of a bind
+ * mount, path_connected allows those cases to be detected.
+ */
+static bool path_connected(const struct path *path)
+{
+       struct vfsmount *mnt = path->mnt;
+
+       /* Only bind mounts can have disconnected paths */
+       if (mnt->mnt_root == mnt->mnt_sb->s_root)
+               return true;
+
+       return is_subdir(path->dentry, mnt->mnt_root);
+}
+
 /*
  * Path walking has 2 modes, rcu-walk and ref-walk (see
  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
@@ -1139,6 +1157,8 @@ static int follow_dotdot_rcu(struct nameidata *nd)
                                goto failed;
                        nd->path.dentry = parent;
                        nd->seq = seq;
+                       if (unlikely(!path_connected(&nd->path)))
+                               goto failed;
                        break;
                }
                if (!follow_up_rcu(&nd->path))
@@ -1234,7 +1254,7 @@ static void follow_mount(struct path *path)
        }
 }
 
-static void follow_dotdot(struct nameidata *nd)
+static int follow_dotdot(struct nameidata *nd)
 {
        if (!nd->root.mnt)
                set_root(nd);
@@ -1250,6 +1270,10 @@ static void follow_dotdot(struct nameidata *nd)
                        /* rare case of legitimate dget_parent()... */
                        nd->path.dentry = dget_parent(nd->path.dentry);
                        dput(old);
+                       if (unlikely(!path_connected(&nd->path))) {
+                               path_put(&nd->path);
+                               return -ENOENT;
+                       }
                        break;
                }
                if (!follow_up(&nd->path))
@@ -1257,6 +1281,7 @@ static void follow_dotdot(struct nameidata *nd)
        }
        follow_mount(&nd->path);
        nd->inode = nd->path.dentry->d_inode;
+       return 0;
 }
 
 /*
@@ -1480,7 +1505,7 @@ static inline int handle_dots(struct nameidata *nd, int 
type)
                        if (follow_dotdot_rcu(nd))
                                return -ECHILD;
                } else
-                       follow_dotdot(nd);
+                       return follow_dotdot(nd);
        }
        return 0;
 }
@@ -2214,7 +2239,7 @@ mountpoint_last(struct nameidata *nd, struct path *path)
        if (unlikely(nd->last_type != LAST_NORM)) {
                error = handle_dots(nd, nd->last_type);
                if (error)
-                       goto out;
+                       return error;
                dentry = dget(nd->path.dentry);
                goto done;
        }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a9902fb..14a5c55 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2272,7 +2272,7 @@ static int _nfs4_do_open(struct inode *dir,
                goto err_free_label;
        state = ctx->state;
 
-       if ((opendata->o_arg.open_flags & O_EXCL) &&
+       if ((opendata->o_arg.open_flags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL) 
&&
            (opendata->o_arg.createmode != NFS4_CREATE_GUARDED)) {
                nfs4_exclusive_attrset(opendata, sattr);
 
@@ -8361,6 +8361,7 @@ static const struct nfs4_minor_version_ops 
nfs_v4_2_minor_ops = {
        .reboot_recovery_ops = &nfs41_reboot_recovery_ops,
        .nograce_recovery_ops = &nfs41_nograce_recovery_ops,
        .state_renewal_ops = &nfs41_state_renewal_ops,
+       .mig_recovery_ops = &nfs41_mig_recovery_ops,
 };
 #endif
 
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 27d7f27..11763ce 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -60,8 +60,8 @@ EXPORT_SYMBOL_GPL(nfs_pgheader_init);
 void nfs_set_pgio_error(struct nfs_pgio_header *hdr, int error, loff_t pos)
 {
        spin_lock(&hdr->lock);
-       if (pos < hdr->io_start + hdr->good_bytes) {
-               set_bit(NFS_IOHDR_ERROR, &hdr->flags);
+       if (!test_and_set_bit(NFS_IOHDR_ERROR, &hdr->flags)
+           || pos < hdr->io_start + hdr->good_bytes) {
                clear_bit(NFS_IOHDR_EOF, &hdr->flags);
                hdr->good_bytes = pos - hdr->io_start;
                hdr->error = error;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index c414929..3e12b38 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1578,8 +1578,8 @@ static int ocfs2_show_options(struct seq_file *s, struct 
dentry *root)
                seq_printf(s, ",localflocks,");
 
        if (osb->osb_cluster_stack[0])
-               seq_printf(s, ",cluster_stack=%.*s", OCFS2_STACK_LABEL_LEN,
-                          osb->osb_cluster_stack);
+               seq_show_option_n(s, "cluster_stack", osb->osb_cluster_stack,
+                                 OCFS2_STACK_LABEL_LEN);
        if (opts & OCFS2_MOUNT_USRQUOTA)
                seq_printf(s, ",usrquota");
        if (opts & OCFS2_MOUNT_GRPQUOTA)
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 3ead145..b2506ca 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -690,18 +690,20 @@ static int reiserfs_show_options(struct seq_file *seq, 
struct dentry *root)
                seq_puts(seq, ",acl");
 
        if (REISERFS_SB(s)->s_jdev)
-               seq_printf(seq, ",jdev=%s", REISERFS_SB(s)->s_jdev);
+               seq_show_option(seq, "jdev", REISERFS_SB(s)->s_jdev);
 
        if (journal->j_max_commit_age != journal->j_default_max_commit_age)
                seq_printf(seq, ",commit=%d", journal->j_max_commit_age);
 
 #ifdef CONFIG_QUOTA
        if (REISERFS_SB(s)->s_qf_names[USRQUOTA])
-               seq_printf(seq, ",usrjquota=%s", 
REISERFS_SB(s)->s_qf_names[USRQUOTA]);
+               seq_show_option(seq, "usrjquota",
+                               REISERFS_SB(s)->s_qf_names[USRQUOTA]);
        else if (opts & (1 << REISERFS_USRQUOTA))
                seq_puts(seq, ",usrquota");
        if (REISERFS_SB(s)->s_qf_names[GRPQUOTA])
-               seq_printf(seq, ",grpjquota=%s", 
REISERFS_SB(s)->s_qf_names[GRPQUOTA]);
+               seq_show_option(seq, "grpjquota",
+                               REISERFS_SB(s)->s_qf_names[GRPQUOTA]);
        else if (opts & (1 << REISERFS_GRPQUOTA))
                seq_puts(seq, ",grpquota");
        if (REISERFS_SB(s)->s_jquota_fmt) {
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index e752236..ebc3107 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -377,7 +377,8 @@ xfs_end_bio(
        xfs_ioend_t             *ioend = bio->bi_private;
 
        ASSERT(atomic_read(&bio->bi_cnt) >= 1);
-       ioend->io_error = test_bit(BIO_UPTODATE, &bio->bi_flags) ? 0 : error;
+       if (!ioend->io_error && !test_bit(BIO_UPTODATE, &bio->bi_flags))
+               ioend->io_error = error;
 
        /* Toss bio and pass work off to an xfsdatad thread */
        bio->bi_private = NULL;
diff --git a/fs/xfs/xfs_da_format.h b/fs/xfs/xfs_da_format.h
index a19d3f8..21848ba 100644
--- a/fs/xfs/xfs_da_format.h
+++ b/fs/xfs/xfs_da_format.h
@@ -834,8 +834,15 @@ typedef struct xfs_attr_leaf_name_remote {
 typedef struct xfs_attr_leafblock {
        xfs_attr_leaf_hdr_t     hdr;    /* constant-structure header block */
        xfs_attr_leaf_entry_t   entries[1];     /* sorted on key, not name */
-       xfs_attr_leaf_name_local_t namelist;    /* grows from bottom of buf */
-       xfs_attr_leaf_name_remote_t valuelist;  /* grows from bottom of buf */
+       /*
+        * The rest of the block contains the following structures after the
+        * leaf entries, growing from the bottom up. The variables are never
+        * referenced and definining them can actually make gcc optimize away
+        * accesses to the 'entries' array above index 0 so don't do that.
+        *
+        * xfs_attr_leaf_name_local_t namelist;
+        * xfs_attr_leaf_name_remote_t valuelist;
+        */
 } xfs_attr_leafblock_t;
 
 /*
diff --git a/fs/xfs/xfs_dir2_data.c b/fs/xfs/xfs_dir2_data.c
index 70acff4..0644f22 100644
--- a/fs/xfs/xfs_dir2_data.c
+++ b/fs/xfs/xfs_dir2_data.c
@@ -252,7 +252,8 @@ xfs_dir3_data_reada_verify(
                return;
        case cpu_to_be32(XFS_DIR2_DATA_MAGIC):
        case cpu_to_be32(XFS_DIR3_DATA_MAGIC):
-               xfs_dir3_data_verify(bp);
+               bp->b_ops = &xfs_dir3_data_buf_ops;
+               bp->b_ops->verify_read(bp);
                return;
        default:
                XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, hdr);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index d971f49..26d7693 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -529,9 +529,9 @@ xfs_showargs(
                seq_printf(m, "," MNTOPT_LOGBSIZE "=%dk", mp->m_logbsize >> 10);
 
        if (mp->m_logname)
-               seq_printf(m, "," MNTOPT_LOGDEV "=%s", mp->m_logname);
+               seq_show_option(m, MNTOPT_LOGDEV, mp->m_logname);
        if (mp->m_rtname)
-               seq_printf(m, "," MNTOPT_RTDEV "=%s", mp->m_rtname);
+               seq_show_option(m, MNTOPT_RTDEV, mp->m_rtname);
 
        if (mp->m_dalign > 0)
                seq_printf(m, "," MNTOPT_SUNIT "=%d",
diff --git a/include/linux/fsl_devices.h b/include/linux/fsl_devices.h
index a82296a..f7103ba 100644
--- a/include/linux/fsl_devices.h
+++ b/include/linux/fsl_devices.h
@@ -92,6 +92,8 @@ struct fsl_usb2_platform_data {
 
        unsigned        suspended:1;
        unsigned        already_suspended:1;
+       unsigned        has_fsl_erratum_a007792:1;
+       unsigned        has_fsl_erratum_a005275:1;
 
        /* register save area for suspend/resume */
        u32             pm_command;
diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
index 256a90a..516c109 100644
--- a/include/linux/iio/iio.h
+++ b/include/linux/iio/iio.h
@@ -694,6 +694,15 @@ int iio_str_to_fixpoint(const char *str, int fract_mult, 
int *integer,
 #define IIO_DEGREE_TO_RAD(deg) (((deg) * 314159ULL + 9000000ULL) / 18000000ULL)
 
 /**
+ * IIO_RAD_TO_DEGREE() - Convert rad to degree
+ * @rad: A value in rad
+ *
+ * Returns the given value converted from rad to degree
+ */
+#define IIO_RAD_TO_DEGREE(rad) \
+       (((rad) * 18000000ULL + 314159ULL / 2) / 314159ULL)
+
+/**
  * IIO_G_TO_M_S_2() - Convert g to meter / second**2
  * @g: A value in g
  *
@@ -701,4 +710,12 @@ int iio_str_to_fixpoint(const char *str, int fract_mult, 
int *integer,
  */
 #define IIO_G_TO_M_S_2(g) ((g) * 980665ULL / 100000ULL)
 
+/**
+ * IIO_M_S_2_TO_G() - Convert meter / second**2 to g
+ * @ms2: A value in meter / second**2
+ *
+ * Returns the given value converted from meter / second**2 to g
+ */
+#define IIO_M_S_2_TO_G(ms2) (((ms2) * 100000ULL + 980665ULL / 2) / 980665ULL)
+
 #endif /* _INDUSTRIAL_IO_H_ */
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index e1fb0f6..385593d 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1042,8 +1042,9 @@ void jbd2_update_log_tail(journal_t *journal, tid_t tid, 
unsigned long block);
 extern void jbd2_journal_commit_transaction(journal_t *);
 
 /* Checkpoint list management */
-int __jbd2_journal_clean_checkpoint_list(journal_t *journal);
+int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy);
 int __jbd2_journal_remove_checkpoint(struct journal_head *);
+void jbd2_journal_destroy_checkpoint(journal_t *journal);
 void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *);
 
 
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 2a2a184..bbaceee 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -170,6 +170,8 @@ enum pci_dev_flags {
        PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2,
        /* Provide indication device is assigned by a Virtual Machine Manager */
        PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4,
+       /* Get VPD from function 0 VPD */
+       PCI_DEV_FLAGS_VPD_REF_F0 = (__force pci_dev_flags_t) (1 << 8),
 };
 
 enum pci_irq_reroute_variant {
diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index 52e0097..6288341 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -158,6 +158,41 @@ static inline struct user_namespace *seq_user_ns(struct 
seq_file *seq)
 #endif
 }
 
+/**
+ * seq_show_options - display mount options with appropriate escapes.
+ * @m: the seq_file handle
+ * @name: the mount option name
+ * @value: the mount option name's value, can be NULL
+ */
+static inline void seq_show_option(struct seq_file *m, const char *name,
+                                  const char *value)
+{
+       seq_putc(m, ',');
+       seq_escape(m, name, ",= \t\n\\");
+       if (value) {
+               seq_putc(m, '=');
+               seq_escape(m, value, ", \t\n\\");
+       }
+}
+
+/**
+ * seq_show_option_n - display mount options with appropriate escapes
+ *                    where @value must be a specific length.
+ * @m: the seq_file handle
+ * @name: the mount option name
+ * @value: the mount option name's value, cannot be NULL
+ * @length: the length of @value to display
+ *
+ * This is a macro since this uses "length" to define the size of the
+ * stack buffer.
+ */
+#define seq_show_option_n(m, name, value, length) {    \
+       char val_buf[length + 1];                       \
+       strncpy(val_buf, value, length);                \
+       val_buf[length] = '\0';                         \
+       seq_show_option(m, name, val_buf);              \
+}
+
 #define SEQ_START_TOKEN ((void *)1)
 /*
  * Helpers for iteration over list_head-s in seq_files
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 6f2aae9..c02e4d7 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1107,11 +1107,12 @@ static int cgroup_show_options(struct seq_file *seq, 
struct dentry *dentry)
        if (root->flags & CGRP_ROOT_XATTR)
                seq_puts(seq, ",xattr");
        if (strlen(root->release_agent_path))
-               seq_printf(seq, ",release_agent=%s", root->release_agent_path);
+               seq_show_option(seq, "release_agent",
+                               root->release_agent_path);
        if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags))
                seq_puts(seq, ",clone_children");
        if (strlen(root->name))
-               seq_printf(seq, ",name=%s", root->name);
+               seq_show_option(seq, "name", root->name);
        mutex_unlock(&cgroup_root_mutex);
        return 0;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 5726bf1..4d2a700 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1751,13 +1751,21 @@ static int check_unshare_flags(unsigned long 
unshare_flags)
                                CLONE_NEWUSER|CLONE_NEWPID))
                return -EINVAL;
        /*
-        * Not implemented, but pretend it works if there is nothing to
-        * unshare. Note that unsharing CLONE_THREAD or CLONE_SIGHAND
-        * needs to unshare vm.
+        * Not implemented, but pretend it works if there is nothing
+        * to unshare.  Note that unsharing the address space or the
+        * signal handlers also need to unshare the signal queues (aka
+        * CLONE_THREAD).
         */
        if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) {
-               /* FIXME: get_task_mm() increments ->mm_users */
-               if (atomic_read(&current->mm->mm_users) > 1)
+               if (!thread_group_empty(current))
+                       return -EINVAL;
+       }
+       if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) {
+               if (atomic_read(&current->sighand->count) > 1)
+                       return -EINVAL;
+       }
+       if (unshare_flags & CLONE_VM) {
+               if (!current_is_single_threaded())
                        return -EINVAL;
        }
 
@@ -1826,16 +1834,16 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
        if (unshare_flags & CLONE_NEWUSER)
                unshare_flags |= CLONE_THREAD | CLONE_FS;
        /*
-        * If unsharing a thread from a thread group, must also unshare vm.
-        */
-       if (unshare_flags & CLONE_THREAD)
-               unshare_flags |= CLONE_VM;
-       /*
         * If unsharing vm, must also unshare signal handlers.
         */
        if (unshare_flags & CLONE_VM)
                unshare_flags |= CLONE_SIGHAND;
        /*
+        * If unsharing a signal handlers, must also unshare the signal queues.
+        */
+       if (unshare_flags & CLONE_SIGHAND)
+               unshare_flags |= CLONE_THREAD;
+       /*
         * If unsharing namespace, must also unshare filesystem information.
         */
        if (unshare_flags & CLONE_NEWNS)
diff --git a/kernel/task_work.c b/kernel/task_work.c
index 8727032..53fa971 100644
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -18,6 +18,8 @@ static struct callback_head work_exited; /* all we need is 
->next == NULL */
  * This is like the signal handler which runs in kernel mode, but it doesn't
  * try to wake up the @task.
  *
+ * Note: there is no ordering guarantee on works queued here.
+ *
  * RETURNS:
  * 0 if succeeds or -ESRCH.
  */
@@ -108,16 +110,6 @@ void task_work_run(void)
                raw_spin_unlock_wait(&task->pi_lock);
                smp_mb();
 
-               /* Reverse the list to run the works in fifo order */
-               head = NULL;
-               do {
-                       next = work->next;
-                       work->next = head;
-                       head = work;
-                       work = next;
-               } while (work);
-
-               work = head;
                do {
                        next = work->next;
                        work->func(work);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index e45f42b..2d18258 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1068,7 +1068,7 @@ cull_mlocked:
                if (PageSwapCache(page))
                        try_to_free_swap(page);
                unlock_page(page);
-               putback_lru_page(page);
+               list_add(&page->lru, &ret_pages);
                continue;
 
 activate_locked:
diff --git a/net/batman-adv/distributed-arp-table.c 
b/net/batman-adv/distributed-arp-table.c
index e086dab..a80dece 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -17,6 +17,7 @@
  * 02110-1301, USA
  */
 
+#include <linux/bitops.h>
 #include <linux/if_ether.h>
 #include <linux/if_arp.h>
 #include <linux/if_vlan.h>
@@ -424,7 +425,7 @@ static bool batadv_is_orig_node_eligible(struct 
batadv_dat_candidate *res,
        int j;
 
        /* check if orig node candidate is running DAT */
-       if (!(candidate->capabilities & BATADV_ORIG_CAPA_HAS_DAT))
+       if (!test_bit(BATADV_ORIG_CAPA_HAS_DAT, &candidate->capabilities))
                goto out;
 
        /* Check if this node has already been selected... */
@@ -681,9 +682,9 @@ static void batadv_dat_tvlv_ogm_handler_v1(struct 
batadv_priv *bat_priv,
                                           uint16_t tvlv_value_len)
 {
        if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
-               orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_DAT;
+               clear_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
        else
-               orig->capabilities |= BATADV_ORIG_CAPA_HAS_DAT;
+               set_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
 }
 
 /**
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 511d7e1..71decc0 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -17,6 +17,7 @@
  * 02110-1301, USA
  */
 
+#include <linux/bitops.h>
 #include <linux/debugfs.h>
 
 #include "main.h"
@@ -106,9 +107,9 @@ static void batadv_nc_tvlv_ogm_handler_v1(struct 
batadv_priv *bat_priv,
                                          uint16_t tvlv_value_len)
 {
        if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
-               orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_NC;
+               clear_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
        else
-               orig->capabilities |= BATADV_ORIG_CAPA_HAS_NC;
+               set_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
 }
 
 /**
@@ -860,7 +861,7 @@ void batadv_nc_update_nc_node(struct batadv_priv *bat_priv,
                goto out;
 
        /* check if orig node is network coding enabled */
-       if (!(orig_node->capabilities & BATADV_ORIG_CAPA_HAS_NC))
+       if (!test_bit(BATADV_ORIG_CAPA_HAS_NC, &orig_node->capabilities))
                goto out;
 
        /* accept ogms from 'good' neighbors and single hop neighbors */
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 91dd369..471bff8 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -217,7 +217,7 @@ struct batadv_orig_node {
        unsigned long last_seen;
        unsigned long bcast_seqno_reset;
        unsigned long batman_seqno_reset;
-       uint8_t capabilities;
+       unsigned long capabilities;
        atomic_t last_ttvn;
        unsigned char *tt_buff;
        int16_t tt_buff_len;
@@ -258,8 +258,8 @@ struct batadv_orig_node {
  * @BATADV_ORIG_CAPA_HAS_NC: orig node has network coding enabled
  */
 enum batadv_orig_capabilities {
-       BATADV_ORIG_CAPA_HAS_DAT = BIT(0),
-       BATADV_ORIG_CAPA_HAS_NC = BIT(1),
+       BATADV_ORIG_CAPA_HAS_DAT,
+       BATADV_ORIG_CAPA_HAS_NC,
 };
 
 /**
diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
index 447a7fb..f5e2ba1 100644
--- a/net/ipv6/exthdrs_offload.c
+++ b/net/ipv6/exthdrs_offload.c
@@ -36,6 +36,6 @@ out:
        return ret;
 
 out_rt:
-       inet_del_offload(&rthdr_offload, IPPROTO_ROUTING);
+       inet6_del_offload(&rthdr_offload, IPPROTO_ROUTING);
        goto out;
 }
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 09cb1052..dc9ce97 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -296,9 +296,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
        if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
                return TX_CONTINUE;
 
-       if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-               return TX_CONTINUE;
-
        if (tx->flags & IEEE80211_TX_PS_BUFFERED)
                return TX_CONTINUE;
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 2b216f1..599757e 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1167,7 +1167,7 @@ static void sctp_v4_del_protocol(void)
        unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
 }
 
-static int __net_init sctp_net_init(struct net *net)
+static int __net_init sctp_defaults_init(struct net *net)
 {
        int status;
 
@@ -1260,12 +1260,6 @@ static int __net_init sctp_net_init(struct net *net)
 
        sctp_dbg_objcnt_init(net);
 
-       /* Initialize the control inode/socket for handling OOTB packets.  */
-       if ((status = sctp_ctl_sock_init(net))) {
-               pr_err("Failed to initialize the SCTP control sock\n");
-               goto err_ctl_sock_init;
-       }
-
        /* Initialize the local address list. */
        INIT_LIST_HEAD(&net->sctp.local_addr_list);
        spin_lock_init(&net->sctp.local_addr_lock);
@@ -1281,9 +1275,6 @@ static int __net_init sctp_net_init(struct net *net)
 
        return 0;
 
-err_ctl_sock_init:
-       sctp_dbg_objcnt_exit(net);
-       sctp_proc_exit(net);
 err_init_proc:
        cleanup_sctp_mibs(net);
 err_init_mibs:
@@ -1292,15 +1283,12 @@ err_sysctl_register:
        return status;
 }
 
-static void __net_exit sctp_net_exit(struct net *net)
+static void __net_exit sctp_defaults_exit(struct net *net)
 {
        /* Free the local address list */
        sctp_free_addr_wq(net);
        sctp_free_local_addr_list(net);
 
-       /* Free the control endpoint.  */
-       inet_ctl_sock_destroy(net->sctp.ctl_sock);
-
        sctp_dbg_objcnt_exit(net);
 
        sctp_proc_exit(net);
@@ -1308,9 +1296,32 @@ static void __net_exit sctp_net_exit(struct net *net)
        sctp_sysctl_net_unregister(net);
 }
 
-static struct pernet_operations sctp_net_ops = {
-       .init = sctp_net_init,
-       .exit = sctp_net_exit,
+static struct pernet_operations sctp_defaults_ops = {
+       .init = sctp_defaults_init,
+       .exit = sctp_defaults_exit,
+};
+
+static int __net_init sctp_ctrlsock_init(struct net *net)
+{
+       int status;
+
+       /* Initialize the control inode/socket for handling OOTB packets.  */
+       status = sctp_ctl_sock_init(net);
+       if (status)
+               pr_err("Failed to initialize the SCTP control sock\n");
+
+       return status;
+}
+
+static void __net_init sctp_ctrlsock_exit(struct net *net)
+{
+       /* Free the control endpoint.  */
+       inet_ctl_sock_destroy(net->sctp.ctl_sock);
+}
+
+static struct pernet_operations sctp_ctrlsock_ops = {
+       .init = sctp_ctrlsock_init,
+       .exit = sctp_ctrlsock_exit,
 };
 
 /* Initialize the universe into something sensible.  */
@@ -1444,8 +1455,11 @@ static __init int sctp_init(void)
        sctp_v4_pf_init();
        sctp_v6_pf_init();
 
-       status = sctp_v4_protosw_init();
+       status = register_pernet_subsys(&sctp_defaults_ops);
+       if (status)
+               goto err_register_defaults;
 
+       status = sctp_v4_protosw_init();
        if (status)
                goto err_protosw_init;
 
@@ -1453,9 +1467,9 @@ static __init int sctp_init(void)
        if (status)
                goto err_v6_protosw_init;
 
-       status = register_pernet_subsys(&sctp_net_ops);
+       status = register_pernet_subsys(&sctp_ctrlsock_ops);
        if (status)
-               goto err_register_pernet_subsys;
+               goto err_register_ctrlsock;
 
        status = sctp_v4_add_protocol();
        if (status)
@@ -1472,12 +1486,14 @@ out:
 err_v6_add_protocol:
        sctp_v4_del_protocol();
 err_add_protocol:
-       unregister_pernet_subsys(&sctp_net_ops);
-err_register_pernet_subsys:
+       unregister_pernet_subsys(&sctp_ctrlsock_ops);
+err_register_ctrlsock:
        sctp_v6_protosw_exit();
 err_v6_protosw_init:
        sctp_v4_protosw_exit();
 err_protosw_init:
+       unregister_pernet_subsys(&sctp_defaults_ops);
+err_register_defaults:
        sctp_v4_pf_exit();
        sctp_v6_pf_exit();
        sctp_sysctl_unregister();
@@ -1510,12 +1526,14 @@ static __exit void sctp_exit(void)
        sctp_v6_del_protocol();
        sctp_v4_del_protocol();
 
-       unregister_pernet_subsys(&sctp_net_ops);
+       unregister_pernet_subsys(&sctp_ctrlsock_ops);
 
        /* Free protosw registrations */
        sctp_v6_protosw_exit();
        sctp_v4_protosw_exit();
 
+       unregister_pernet_subsys(&sctp_defaults_ops);
+
        /* Unregister with socket layer. */
        sctp_v6_pf_exit();
        sctp_v4_pf_exit();
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3138402..3b38a36 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1101,7 +1101,7 @@ static void selinux_write_opts(struct seq_file *m,
                seq_puts(m, prefix);
                if (has_comma)
                        seq_putc(m, '\"');
-               seq_puts(m, opts->mnt_opts[i]);
+               seq_escape(m, opts->mnt_opts[i], "\"\n\\");
                if (has_comma)
                        seq_putc(m, '\"');
        }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4535173..e8fda21 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1154,7 +1154,7 @@ static const struct hda_fixup alc880_fixups[] = {
                /* override all pins as BIOS on old Amilo is broken */
                .type = HDA_FIXUP_PINS,
                .v.pins = (const struct hda_pintbl[]) {
-                       { 0x14, 0x0121411f }, /* HP */
+                       { 0x14, 0x0121401f }, /* HP */
                        { 0x15, 0x99030120 }, /* speaker */
                        { 0x16, 0x99030130 }, /* bass speaker */
                        { 0x17, 0x411111f0 }, /* N/A */
@@ -1174,7 +1174,7 @@ static const struct hda_fixup alc880_fixups[] = {
                /* almost compatible with FUJITSU, but no bass and SPDIF */
                .type = HDA_FIXUP_PINS,
                .v.pins = (const struct hda_pintbl[]) {
-                       { 0x14, 0x0121411f }, /* HP */
+                       { 0x14, 0x0121401f }, /* HP */
                        { 0x15, 0x99030120 }, /* speaker */
                        { 0x16, 0x411111f0 }, /* N/A */
                        { 0x17, 0x411111f0 }, /* N/A */
@@ -1382,7 +1382,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
        SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810),
        SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", 
ALC880_FIXUP_MEDION_RIM),
        SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST_AUTOMUTE),
-       SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734),
+       SND_PCI_QUIRK(0x1734, 0x107c, "FSC Amilo M1437", ALC880_FIXUP_FUJITSU),
        SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU),
        SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734),
        SND_PCI_QUIRK(0x1734, 0x10b0, "FSC Amilo Pi1556", ALC880_FIXUP_FUJITSU),
diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
index 10f6c99..7eab0c1 100644
--- a/sound/soc/codecs/adav80x.c
+++ b/sound/soc/codecs/adav80x.c
@@ -902,7 +902,6 @@ static const struct regmap_config adav80x_spi_regmap_config 
= {
        .val_bits = 8,
        .pad_bits = 1,
        .reg_bits = 7,
-       .read_flag_mask = 0x01,
 
        .max_register = ADAV80X_PLL_OUTE,
 
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index ee0d565..ba2c8ed 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1060,7 +1060,7 @@ static void abs_printout(int cpu, int nr, struct 
perf_evsel *evsel, double avg)
 static void print_aggr(char *prefix)
 {
        struct perf_evsel *counter;
-       int cpu, cpu2, s, s2, id, nr;
+       int cpu, s, s2, id, nr;
        u64 ena, run, val;
 
        if (!(aggr_map || aggr_get_id))
@@ -1072,8 +1072,7 @@ static void print_aggr(char *prefix)
                        val = ena = run = 0;
                        nr = 0;
                        for (cpu = 0; cpu < perf_evsel__nr_cpus(counter); 
cpu++) {
-                               cpu2 = perf_evsel__cpus(counter)->map[cpu];
-                               s2 = aggr_get_id(evsel_list->cpus, cpu2);
+                               s2 = aggr_get_id(perf_evsel__cpus(counter), 
cpu);
                                if (s2 != id)
                                        continue;
                                val += counter->counts->cpu[cpu].val;
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 822903e..c848cf5 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -161,6 +161,9 @@ void hists__calc_col_len(struct hists *hists, struct 
hist_entry *h)
        hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12);
        hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12);
 
+       if (h->srcline)
+               hists__new_col_len(hists, HISTC_SRCLINE, strlen(h->srcline));
+
        if (h->transaction)
                hists__new_col_len(hists, HISTC_TRANSACTION,
                                   hist_entry__transaction_len());
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to