diff --git a/MAINTAINERS b/MAINTAINERS
index 24ee99d..d72b5ff 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -206,13 +206,13 @@ F:        drivers/scsi/aacraid/
 
 ABIT UGURU 1,2 HARDWARE MONITOR DRIVER
 M:     Hans de Goede <hdego...@redhat.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/abituguru.c
 
 ABIT UGURU 3 HARDWARE MONITOR DRIVER
 M:     Alistair John Strachan <alist...@devzero.co.uk>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/abituguru3.c
 
@@ -340,15 +340,15 @@ M:        Jiri Kosina <jkos...@suse.cz>
 S:     Maintained
 
 ADM1025 HARDWARE MONITOR DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/adm1025
 F:     drivers/hwmon/adm1025.c
 
 ADM1029 HARDWARE MONITOR DRIVER
-M:     Corentin Labbe <corentin.la...@geomatys.fr>
-L:     lm-sens...@lm-sensors.org
+M:     Corentin Labbe <clabbe.montj...@gmail.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/adm1029.c
 
@@ -393,7 +393,7 @@ F:  drivers/video/backlight/adp8860_bl.c
 
 ADS1015 HARDWARE MONITOR DRIVER
 M:     Dirk Eibach <eib...@gdsys.de>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/ads1015
 F:     drivers/hwmon/ads1015.c
@@ -405,8 +405,8 @@ S:  Maintained
 F:     drivers/macintosh/therm_adt746x.c
 
 ADT7475 HARDWARE MONITOR DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/adt7475
 F:     drivers/hwmon/adt7475.c
@@ -540,9 +540,9 @@ F:  include/linux/altera_uart.h
 F:     include/linux/altera_jtaguart.h
 
 AMD FAM15H PROCESSOR POWER MONITORING DRIVER
-M:     Andreas Herrmann <herrmann.der.u...@googlemail.com>
-L:     lm-sens...@lm-sensors.org
-S:     Maintained
+M:     Huang Rui <ray.hu...@amd.com>
+L:     linux-hw...@vger.kernel.org
+S:     Supported
 F:     Documentation/hwmon/fam15h_power
 F:     drivers/hwmon/fam15h_power.c
 
@@ -654,9 +654,9 @@ S:  Maintained
 F:     drivers/input/mouse/bcm5974.c
 
 APPLE SMC DRIVER
-M:     Henrik Rydberg <rydb...@euromail.se>
-L:     lm-sens...@lm-sensors.org
-S:     Maintained
+M:     Henrik Rydberg <rydb...@bitmath.org>
+L:     linux-hw...@vger.kernel.org
+S:     Odd fixes
 F:     drivers/hwmon/applesmc.c
 
 APPLETALK NETWORK LAYER
@@ -1396,7 +1396,7 @@ F:        include/media/as3645a.h
 
 ASC7621 HARDWARE MONITOR DRIVER
 M:     George Joseph <george.jos...@fairview5.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/asc7621
 F:     drivers/hwmon/asc7621.c
@@ -1486,7 +1486,7 @@ F:        drivers/net/wireless/ath/carl9170/
 
 ATK0110 HWMON DRIVER
 M:     Luca Tettamanti <kronos...@gmail.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/asus_atk0110.c
 
@@ -2312,7 +2312,7 @@ F:        mm/*cgroup*
 
 CORETEMP HARDWARE MONITORING DRIVER
 M:     Fenghua Yu <fenghua...@intel.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/coretemp
 F:     drivers/hwmon/coretemp.c
@@ -2759,7 +2759,7 @@ T:        git 
git://git.infradead.org/users/vkoul/slave-dma.git (slave-dma)
 
 DME1737 HARDWARE MONITOR DRIVER
 M:     Juerg Haefliger <jue...@gmail.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/dme1737
 F:     drivers/hwmon/dme1737.c
@@ -3356,8 +3356,8 @@ F:        drivers/video/exynos/exynos_mipi*
 F:     include/video/exynos_mipi*
 
 F71805F HARDWARE MONITORING DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/f71805f
 F:     drivers/hwmon/f71805f.c
@@ -3429,7 +3429,7 @@ F:        fs/*
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:     Riku Voipio <riku.voi...@iki.fi>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/f75375s.c
 F:     include/linux/f75375s.h
@@ -3884,9 +3884,9 @@ F:        drivers/tty/hvc/
 HARDWARE MONITORING
 M:     Jean Delvare <kh...@linux-fr.org>
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
-W:     http://www.lm-sensors.org/
-T:     quilt 
kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-hwmon/
+L:     linux-hw...@vger.kernel.org
+W:     http://hwmon.wiki.kernel.org/
+T:     quilt http://jdelvare.nerim.net/devel/linux/jdelvare-hwmon/
 T:     git 
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git
 S:     Maintained
 F:     Documentation/hwmon/
@@ -4317,7 +4317,7 @@ F:        drivers/usb/atm/ueagle-atm.c
 
 INA209 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/ina209
 F:     Documentation/devicetree/bindings/i2c/ina209.txt
@@ -4325,7 +4325,7 @@ F:        drivers/hwmon/ina209.c
 
 INA2XX HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/ina2xx
 F:     drivers/hwmon/ina2xx.c
@@ -4728,8 +4728,8 @@ S:        Maintained
 F:     drivers/isdn/hardware/eicon/
 
 IT87 HARDWARE MONITORING DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/it87
 F:     drivers/hwmon/it87.c
@@ -4781,7 +4781,7 @@ F:        drivers/media/dvb-frontends/ix2505v*
 
 JC42.4 TEMPERATURE SENSOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/jc42.c
 F:     Documentation/hwmon/jc42
@@ -4832,14 +4832,14 @@ F:      drivers/tty/serial/jsm/
 
 K10TEMP HARDWARE MONITORING DRIVER
 M:     Clemens Ladisch <clem...@ladisch.de>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/k10temp
 F:     drivers/hwmon/k10temp.c
 
 K8TEMP HARDWARE MONITORING DRIVER
 M:     Rudolf Marek <r.ma...@assembler.cz>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/k8temp
 F:     drivers/hwmon/k8temp.c
@@ -5236,27 +5236,27 @@ F:      net/llc/
 
 LM73 HARDWARE MONITOR DRIVER
 M:     Guillaume Ligneul <guillaume.lign...@gmail.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/lm73.c
 
 LM78 HARDWARE MONITOR DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/lm78
 F:     drivers/hwmon/lm78.c
 
 LM83 HARDWARE MONITOR DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/lm83
 F:     drivers/hwmon/lm83.c
 
 LM90 HARDWARE MONITOR DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/lm90
 F:     Documentation/devicetree/bindings/hwmon/lm90.txt
@@ -5264,7 +5264,7 @@ F:        drivers/hwmon/lm90.c
 
 LM95234 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/lm95234
 F:     drivers/hwmon/lm95234.c
@@ -5329,7 +5329,7 @@ F:        drivers/scsi/sym53c8xx_2/
 
 LTC4261 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/ltc4261
 F:     drivers/hwmon/ltc4261.c
@@ -5475,21 +5475,21 @@ F:      include/uapi/linux/matroxfb.h
 
 MAX16065 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/max16065
 F:     drivers/hwmon/max16065.c
 
 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:     "Hans J. Koch" <h...@hansjkoch.de>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/max6650
 F:     drivers/hwmon/max6650.c
 
 MAX6697 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/max6697
 F:     Documentation/devicetree/bindings/i2c/max6697.txt
@@ -5808,7 +5808,7 @@ F:        drivers/scsi/NCR_D700.*
 
 NCT6775 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/nct6775
 F:     drivers/hwmon/nct6775.c
@@ -6436,7 +6436,7 @@ F:        drivers/video/logo/logo_parisc*
 
 PC87360 HARDWARE MONITORING DRIVER
 M:     Jim Cromie <jim.cro...@gmail.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/pc87360
 F:     drivers/hwmon/pc87360.c
@@ -6447,8 +6447,8 @@ S:        Maintained
 F:     drivers/char/pc8736x_gpio.c
 
 PC87427 HARDWARE MONITORING DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/pc87427
 F:     drivers/hwmon/pc87427.c
@@ -6674,8 +6674,8 @@ F:        drivers/rtc/rtc-puv3.c
 
 PMBUS HARDWARE MONITORING DRIVERS
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
-W:     http://www.lm-sensors.org/
+L:     linux-hw...@vger.kernel.org
+W:     http://hwmon.wiki.kernel.org/
 W:     http://www.roeck-us.net/linux/drivers/
 T:     git 
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git
 S:     Maintained
@@ -7851,28 +7851,28 @@ F:      drivers/media/i2c/smiapp-pll.h
 
 SMM665 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/smm665
 F:     drivers/hwmon/smm665.c
 
 SMSC EMC2103 HARDWARE MONITOR DRIVER
 M:     Steve Glendinning <steve.glendinn...@shawell.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/emc2103
 F:     drivers/hwmon/emc2103.c
 
 SMSC SCH5627 HARDWARE MONITOR DRIVER
 M:     Hans de Goede <hdego...@redhat.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Supported
 F:     Documentation/hwmon/sch5627
 F:     drivers/hwmon/sch5627.c
 
 SMSC47B397 HARDWARE MONITOR DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/smsc47b397
 F:     drivers/hwmon/smsc47b397.c
@@ -8714,7 +8714,7 @@ F:        include/linux/mmc/sh_mobile_sdhi.h
 
 TMP401 HARDWARE MONITOR DRIVER
 M:     Guenter Roeck <li...@roeck-us.net>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/tmp401
 F:     drivers/hwmon/tmp401.c
@@ -9356,14 +9356,14 @@ F:      include/linux/regulator/
 
 VT1211 HARDWARE MONITOR DRIVER
 M:     Juerg Haefliger <jue...@gmail.com>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/vt1211
 F:     drivers/hwmon/vt1211.c
 
 VT8231 HARDWARE MONITOR DRIVER
 M:     Roger Lucas <vt8...@hiddenengine.co.uk>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/vt8231.c
 
@@ -9382,21 +9382,21 @@ F:      drivers/w1/
 
 W83791D HARDWARE MONITORING DRIVER
 M:     Marc Hulsman <m.huls...@tudelft.nl>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/w83791d
 F:     drivers/hwmon/w83791d.c
 
 W83793 HARDWARE MONITORING DRIVER
 M:     Rudolf Marek <r.ma...@assembler.cz>
-L:     lm-sens...@lm-sensors.org
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     Documentation/hwmon/w83793
 F:     drivers/hwmon/w83793.c
 
 W83795 HARDWARE MONITORING DRIVER
-M:     Jean Delvare <kh...@linux-fr.org>
-L:     lm-sens...@lm-sensors.org
+M:     Jean Delvare <jdelv...@suse.com>
+L:     linux-hw...@vger.kernel.org
 S:     Maintained
 F:     drivers/hwmon/w83795.c
 
diff --git a/Makefile b/Makefile
index dad16cf..fb90bd5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 13
 SUBLEVEL = 11
-EXTRAVERSION = -ckt37
+EXTRAVERSION = -ckt38
 NAME = King of Alienated Frog Porn
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-omap2/cpuidle34xx.c 
b/arch/arm/mach-omap2/cpuidle34xx.c
index e18709d..38e1bdc 100644
--- a/arch/arm/mach-omap2/cpuidle34xx.c
+++ b/arch/arm/mach-omap2/cpuidle34xx.c
@@ -34,6 +34,7 @@
 #include "pm.h"
 #include "control.h"
 #include "common.h"
+#include "soc.h"
 
 /* Mach specific information to be recorded in the C-state driver_data */
 struct omap3_idle_statedata {
@@ -322,6 +323,69 @@ static struct cpuidle_driver omap3_idle_driver = {
        .safe_state_index = 0,
 };
 
+/*
+ * Numbers based on measurements made in October 2009 for PM optimized kernel
+ * with CPU freq enabled on device Nokia N900. Assumes OPP2 (main idle OPP,
+ * and worst case latencies).
+ */
+static struct cpuidle_driver omap3430_idle_driver = {
+       .name             = "omap3430_idle",
+       .owner            = THIS_MODULE,
+       .states = {
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 110 + 162,
+                       .target_residency = 5,
+                       .name             = "C1",
+                       .desc             = "MPU ON + CORE ON",
+               },
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 106 + 180,
+                       .target_residency = 309,
+                       .name             = "C2",
+                       .desc             = "MPU ON + CORE ON",
+               },
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 107 + 410,
+                       .target_residency = 46057,
+                       .name             = "C3",
+                       .desc             = "MPU RET + CORE ON",
+               },
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 121 + 3374,
+                       .target_residency = 46057,
+                       .name             = "C4",
+                       .desc             = "MPU OFF + CORE ON",
+               },
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 855 + 1146,
+                       .target_residency = 46057,
+                       .name             = "C5",
+                       .desc             = "MPU RET + CORE RET",
+               },
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 7580 + 4134,
+                       .target_residency = 484329,
+                       .name             = "C6",
+                       .desc             = "MPU OFF + CORE RET",
+               },
+               {
+                       .enter            = omap3_enter_idle_bm,
+                       .exit_latency     = 7505 + 15274,
+                       .target_residency = 484329,
+                       .name             = "C7",
+                       .desc             = "MPU OFF + CORE OFF",
+               },
+       },
+       .state_count = ARRAY_SIZE(omap3_idle_data),
+       .safe_state_index = 0,
+};
+
 /* Public functions */
 
 /**
@@ -340,5 +404,8 @@ int __init omap3_idle_init(void)
        if (!mpu_pd || !core_pd || !per_pd || !cam_pd)
                return -ENODEV;
 
-       return cpuidle_register(&omap3_idle_driver, NULL);
+       if (cpu_is_omap3430())
+               return cpuidle_register(&omap3430_idle_driver, NULL);
+       else
+               return cpuidle_register(&omap3_idle_driver, NULL);
 }
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index c129ab2..33932ce 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -48,7 +48,7 @@ struct zpci_fmb {
        atomic64_t allocated_pages;
        atomic64_t mapped_pages;
        atomic64_t unmapped_pages;
-} __packed __aligned(16);
+} __packed __aligned(64);
 
 #define ZPCI_MSI_VEC_BITS      11
 #define ZPCI_MSI_VEC_MAX       (1 << ZPCI_MSI_VEC_BITS)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index bf7c73d..710056d 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -895,8 +895,11 @@ static inline int barsize(u8 size)
 
 static int zpci_mem_init(void)
 {
+       BUILD_BUG_ON(!is_power_of_2(__alignof__(struct zpci_fmb)) ||
+                    __alignof__(struct zpci_fmb) < sizeof(struct zpci_fmb));
+
        zdev_fmb_cache = kmem_cache_create("PCI_FMB_cache", sizeof(struct 
zpci_fmb),
-                               16, 0, NULL);
+                                          __alignof__(struct zpci_fmb), 0, 
NULL);
        if (!zdev_fmb_cache)
                goto error_zdev;
 
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 29880c9..e22e572 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *req)
        ptr += strlen("proc");
        ptr = skip_spaces(ptr);
 
-       file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY);
+       file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY, 0);
        if (IS_ERR(file)) {
                mconsole_reply(req, "Failed to open file", 1, 0);
                printk(KERN_ERR "open /proc/%s: %ld\n", ptr, PTR_ERR(file));
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 1d2091a..2955983 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -699,8 +699,8 @@ static inline void entering_irq(void)
 
 static inline void entering_ack_irq(void)
 {
-       ack_APIC_irq();
        entering_irq();
+       ack_APIC_irq();
 }
 
 static inline void exiting_irq(void)
diff --git a/arch/x86/include/asm/xen/hypervisor.h 
b/arch/x86/include/asm/xen/hypervisor.h
index d866959..d2ad00a 100644
--- a/arch/x86/include/asm/xen/hypervisor.h
+++ b/arch/x86/include/asm/xen/hypervisor.h
@@ -57,4 +57,6 @@ static inline bool xen_x2apic_para_available(void)
 }
 #endif
 
+extern void xen_set_iopl_mask(unsigned mask);
+
 #endif /* _ASM_X86_XEN_HYPERVISOR_H */
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index c1a8618..9062507b 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -442,6 +442,7 @@ struct x86_pmu {
                        pebs_active     :1,
                        pebs_broken     :1;
        int             pebs_record_size;
+       int             pebs_buffer_size;
        void            (*drain_pebs)(struct pt_regs *regs);
        struct event_constraint *pebs_constraints;
        void            (*pebs_aliases)(struct perf_event *event);
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c 
b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index ae96cfa..3ba3fba 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -241,7 +241,7 @@ static int alloc_pebs_buffer(int cpu)
        if (!x86_pmu.pebs)
                return 0;
 
-       buffer = kzalloc_node(PEBS_BUFFER_SIZE, GFP_KERNEL, node);
+       buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node);
        if (unlikely(!buffer))
                return -ENOMEM;
 
@@ -258,7 +258,7 @@ static int alloc_pebs_buffer(int cpu)
                per_cpu(insn_buffer, cpu) = ibuffer;
        }
 
-       max = PEBS_BUFFER_SIZE / x86_pmu.pebs_record_size;
+       max = x86_pmu.pebs_buffer_size / x86_pmu.pebs_record_size;
 
        ds->pebs_buffer_base = (u64)(unsigned long)buffer;
        ds->pebs_index = ds->pebs_buffer_base;
@@ -1047,6 +1047,7 @@ void intel_ds_init(void)
 
        x86_pmu.bts  = boot_cpu_has(X86_FEATURE_BTS);
        x86_pmu.pebs = boot_cpu_has(X86_FEATURE_PEBS);
+       x86_pmu.pebs_buffer_size = PEBS_BUFFER_SIZE;
        if (x86_pmu.pebs) {
                char pebs_type = x86_pmu.intel_cap.pebs_trap ?  '+' : '-';
                int format = x86_pmu.intel_cap.pebs_format;
@@ -1055,6 +1056,14 @@ void intel_ds_init(void)
                case 0:
                        printk(KERN_CONT "PEBS fmt0%c, ", pebs_type);
                        x86_pmu.pebs_record_size = sizeof(struct 
pebs_record_core);
+                       /*
+                        * Using >PAGE_SIZE buffers makes the WRMSR to
+                        * PERF_GLOBAL_CTRL in intel_pmu_enable_all()
+                        * mysteriously hang on Core2.
+                        *
+                        * As a workaround, we don't do this.
+                        */
+                       x86_pmu.pebs_buffer_size = PAGE_SIZE;
                        x86_pmu.drain_pebs = intel_pmu_drain_pebs_core;
                        break;
 
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index 4ddaf66..792621a 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -96,9 +96,14 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long 
num, int turn_on)
 SYSCALL_DEFINE1(iopl, unsigned int, level)
 {
        struct pt_regs *regs = current_pt_regs();
-       unsigned int old = (regs->flags >> 12) & 3;
        struct thread_struct *t = &current->thread;
 
+       /*
+        * Careful: the IOPL bits in regs->flags are undefined under Xen PV
+        * and changing them has no effect.
+        */
+       unsigned int old = t->iopl >> X86_EFLAGS_IOPL_BIT;
+
        if (level > 3)
                return -EINVAL;
        /* Trying to gain more privileges? */
@@ -106,8 +111,9 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
                if (!capable(CAP_SYS_RAWIO))
                        return -EPERM;
        }
-       regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
-       t->iopl = level << 12;
+       regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) |
+               (level << X86_EFLAGS_IOPL_BIT);
+       t->iopl = level << X86_EFLAGS_IOPL_BIT;
        set_iopl_mask(t->iopl);
 
        return 0;
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index e2d26ce..4b8716d 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -49,6 +49,7 @@
 #include <asm/syscalls.h>
 #include <asm/debugreg.h>
 #include <asm/switch_to.h>
+#include <asm/xen/hypervisor.h>
 
 asmlinkage extern void ret_from_fork(void);
 
@@ -427,6 +428,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct 
*next_p)
                     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
                __switch_to_xtra(prev_p, next_p, tss);
 
+#ifdef CONFIG_XEN
+       /*
+        * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
+        * current_pt_regs()->flags may not match the current task's
+        * intended IOPL.  We need to switch it manually.
+        */
+       if (unlikely(xen_pv_domain() &&
+                    prev->iopl != next->iopl))
+               xen_set_iopl_mask(next->iopl);
+#endif
+
        return prev_p;
 }
 
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index f2006e6..4af2f8f 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -244,7 +244,7 @@ static void kvm_pit_ack_irq(struct kvm_irq_ack_notifier 
*kian)
                 * PIC is being reset.  Handle it gracefully here
                 */
                atomic_inc(&ps->pending);
-       else if (value > 0)
+       else if (value > 0 && ps->reinject)
                /* in this case, we had multiple outstanding pit interrupts
                 * that we needed to inject.  Reinject
                 */
@@ -287,7 +287,9 @@ static void pit_do_work(struct kthread_work *work)
         * last one has been acked.
         */
        spin_lock(&ps->inject_lock);
-       if (ps->irq_ack) {
+       if (!ps->reinject)
+               inject = 1;
+       else if (ps->irq_ack) {
                ps->irq_ack = 0;
                inject = 1;
        }
@@ -316,10 +318,10 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer 
*data)
        struct kvm_kpit_state *ps = container_of(data, struct kvm_kpit_state, 
timer);
        struct kvm_pit *pt = ps->kvm->arch.vpit;
 
-       if (ps->reinject || !atomic_read(&ps->pending)) {
+       if (ps->reinject)
                atomic_inc(&ps->pending);
-               queue_kthread_work(&pt->worker, &pt->expired);
-       }
+
+       queue_kthread_work(&pt->worker, &pt->expired);
 
        if (ps->is_periodic) {
                hrtimer_add_expires_ns(&ps->timer, ps->period);
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 6c1cd48..103762c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6392,6 +6392,7 @@ static int handle_invept(struct kvm_vcpu *vcpu)
        if (!(types & (1UL << type))) {
                nested_vmx_failValid(vcpu,
                                VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+               skip_emulated_instruction(vcpu);
                return 1;
        }
 
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index ed4de42..bd64cdd 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -539,3 +539,10 @@ static void twinhead_reserve_killing_zone(struct pci_dev 
*dev)
         }
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, 
twinhead_reserve_killing_zone);
+
+static void pci_bdwep_bar(struct pci_dev *dev)
+{
+       dev->non_compliant_bars = 1;
+}
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index b2de632..7c8af52 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -955,7 +955,7 @@ static void xen_load_sp0(struct tss_struct *tss,
        xen_mc_issue(PARAVIRT_LAZY_CPU);
 }
 
-static void xen_set_iopl_mask(unsigned mask)
+void xen_set_iopl_mask(unsigned mask)
 {
        struct physdev_set_iopl set_iopl;
 
diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
index 1ae90af..ca0c4c1 100644
--- a/arch/xtensa/kernel/head.S
+++ b/arch/xtensa/kernel/head.S
@@ -118,7 +118,7 @@ ENTRY(_startup)
        wsr     a0, icountlevel
 
        .set    _index, 0
-       .rept   XCHAL_NUM_DBREAK - 1
+       .rept   XCHAL_NUM_DBREAK
        wsr     a0, SREG_DBREAKC + _index
        .set    _index, _index + 1
        .endr
diff --git a/arch/xtensa/platforms/iss/console.c 
b/arch/xtensa/platforms/iss/console.c
index 70cb408..92d785f 100644
--- a/arch/xtensa/platforms/iss/console.c
+++ b/arch/xtensa/platforms/iss/console.c
@@ -100,21 +100,23 @@ static void rs_poll(unsigned long priv)
 {
        struct tty_port *port = (struct tty_port *)priv;
        int i = 0;
+       int rd = 1;
        unsigned char c;
 
        spin_lock(&timer_lock);
 
        while (simc_poll(0)) {
-               simc_read(0, &c, 1);
+               rd = simc_read(0, &c, 1);
+               if (rd <= 0)
+                       break;
                tty_insert_flip_char(port, c, TTY_NORMAL);
                i++;
        }
 
        if (i)
                tty_flip_buffer_push(port);
-
-
-       mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
+       if (rd)
+               mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
        spin_unlock(&timer_lock);
 }
 
diff --git a/drivers/block/mtip32xx/mtip32xx.c 
b/drivers/block/mtip32xx/mtip32xx.c
index 3ea2bde..f2a7e5c 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -1317,6 +1317,7 @@ static int mtip_exec_internal_command(struct mtip_port 
*port,
        struct mtip_cmd *int_cmd = &port->commands[MTIP_TAG_INTERNAL];
        unsigned long to;
        struct driver_data *dd = port->dd;
+       unsigned long start;
 
        /* Make sure the buffer is 8 byte aligned. This is asic specific. */
        if (buffer & 0x00000007) {
@@ -1389,6 +1390,8 @@ static int mtip_exec_internal_command(struct mtip_port 
*port,
        /* Populate the command header */
        int_cmd->command_header->byte_count = 0;
 
+       start = jiffies;
+
        /* Issue the command to the hardware */
        mtip_issue_non_ncq_command(port, MTIP_TAG_INTERNAL);
 
@@ -1399,8 +1402,9 @@ static int mtip_exec_internal_command(struct mtip_port 
*port,
                                msecs_to_jiffies(timeout)) <= 0) {
                        if (rv == -ERESTARTSYS) { /* interrupted */
                                dev_err(&dd->pdev->dev,
-                                       "Internal command [%02X] was 
interrupted after %lu ms\n",
-                                       fis->command, timeout);
+                                       "Internal command [%02X] was 
interrupted after %u ms\n",
+                                       fis->command,
+                                       jiffies_to_msecs(jiffies - start));
                                rv = -EINTR;
                                goto exec_ic_exit;
                        } else if (rv == 0) /* timeout */
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index b71f439..708b40c 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -581,8 +581,8 @@ static void do_nbd_request(struct request_queue *q)
                BUG_ON(nbd->magic != NBD_MAGIC);
 
                if (unlikely(!nbd->sock)) {
-                       dev_err(disk_to_dev(nbd->disk),
-                               "Attempted send on closed socket\n");
+                       dev_err_ratelimited(disk_to_dev(nbd->disk),
+                                           "Attempted send on closed 
socket\n");
                        req->errors++;
                        nbd_end_request(req);
                        spin_lock_irq(q->queue_lock);
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 19ad8f0..897b6b9 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -126,7 +126,7 @@
 */
 #include <linux/types.h>
 
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PD_MAJOR;
 static char *name = PD_NAME;
 static int cluster = 64;
@@ -161,7 +161,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, 
D_SLV};
 static DEFINE_MUTEX(pd_mutex);
 static DEFINE_SPINLOCK(pd_lock);
 
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param(cluster, int, 0);
diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
index 2596042..ada4505 100644
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -117,7 +117,7 @@
 
 */
 
-static bool verbose = 0;
+static int verbose = 0;
 static int major = PT_MAJOR;
 static char *name = PT_NAME;
 static int disable = 0;
@@ -152,7 +152,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, 
&drive3};
 
 #include <asm/uaccess.h>
 
-module_param(verbose, bool, 0);
+module_param(verbose, int, 0);
 module_param(major, int, 0);
 module_param(name, charp, 0);
 module_param_array(drive0, int, NULL, 0);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 120a5fb..2322775 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -81,6 +81,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x0489, 0xe05f) },
        { USB_DEVICE(0x0489, 0xe076) },
        { USB_DEVICE(0x0489, 0xe078) },
+       { USB_DEVICE(0x0489, 0xe095) },
        { USB_DEVICE(0x04c5, 0x1330) },
        { USB_DEVICE(0x04CA, 0x3004) },
        { USB_DEVICE(0x04CA, 0x3005) },
@@ -90,6 +91,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x300d) },
        { USB_DEVICE(0x04CA, 0x300f) },
        { USB_DEVICE(0x04CA, 0x3010) },
+       { USB_DEVICE(0x04CA, 0x3014) },
        { USB_DEVICE(0x0930, 0x0219) },
        { USB_DEVICE(0x0930, 0x021c) },
        { USB_DEVICE(0x0930, 0x0220) },
@@ -110,10 +112,12 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x13d3, 0x3362) },
        { USB_DEVICE(0x13d3, 0x3375) },
        { USB_DEVICE(0x13d3, 0x3393) },
+       { USB_DEVICE(0x13d3, 0x3395) },
        { USB_DEVICE(0x13d3, 0x3402) },
        { USB_DEVICE(0x13d3, 0x3408) },
        { USB_DEVICE(0x13d3, 0x3423) },
        { USB_DEVICE(0x13d3, 0x3432) },
+       { USB_DEVICE(0x13d3, 0x3472) },
        { USB_DEVICE(0x13d3, 0x3474) },
 
        /* Atheros AR5BBU12 with sflash firmware */
@@ -141,6 +145,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
@@ -150,6 +155,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
@@ -170,10 +176,12 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 
        /* Atheros AR5BBU22 with sflash firmware */
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fe2fbeb..ac846e5 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -159,6 +159,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
@@ -168,6 +169,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
@@ -188,10 +190,12 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+       { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 
        /* Atheros AR5BBU12 with sflash firmware */
diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
index 3ef58c8..78737f4 100644
--- a/drivers/bus/imx-weim.c
+++ b/drivers/bus/imx-weim.c
@@ -92,7 +92,7 @@ static int __init weim_parse_dt(struct platform_device *pdev,
        struct device_node *child;
        int ret;
 
-       for_each_child_of_node(pdev->dev.of_node, child) {
+       for_each_available_child_of_node(pdev->dev.of_node, child) {
                if (!child->name)
                        continue;
 
diff --git a/drivers/clk/clk-xgene.c b/drivers/clk/clk-xgene.c
index 1ec5fe8..d9421f8 100644
--- a/drivers/clk/clk-xgene.c
+++ b/drivers/clk/clk-xgene.c
@@ -351,8 +351,8 @@ static int xgene_clk_set_rate(struct clk_hw *hw, unsigned 
long rate,
                /* Set new divider */
                data = xgene_clk_read(pclk->param.divider_reg +
                                pclk->param.reg_divider_offset);
-               data &= ~((1 << pclk->param.reg_divider_width) - 1)
-                               << pclk->param.reg_divider_shift;
+               data &= ~(((1 << pclk->param.reg_divider_width) - 1)
+                               << pclk->param.reg_divider_shift);
                data |= divider;
                xgene_clk_write(data, pclk->param.divider_reg +
                                        pclk->param.reg_divider_offset);
diff --git a/drivers/clk/versatile/clk-sp810.c 
b/drivers/clk/versatile/clk-sp810.c
index b9e05bd..a21e2fa 100644
--- a/drivers/clk/versatile/clk-sp810.c
+++ b/drivers/clk/versatile/clk-sp810.c
@@ -141,6 +141,7 @@ void __init clk_sp810_of_setup(struct device_node *node)
        const char *parent_names[2];
        char name[12];
        struct clk_init_data init;
+       static int instance;
        int i;
 
        if (!sp810) {
@@ -172,7 +173,7 @@ void __init clk_sp810_of_setup(struct device_node *node)
        init.num_parents = ARRAY_SIZE(parent_names);
 
        for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) {
-               snprintf(name, ARRAY_SIZE(name), "timerclken%d", i);
+               snprintf(name, sizeof(name), "sp810_%d_%d", instance, i);
 
                sp810->timerclken[i].sp810 = sp810;
                sp810->timerclken[i].channel = i;
@@ -184,5 +185,6 @@ void __init clk_sp810_of_setup(struct device_node *node)
        }
 
        of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810);
+       instance++;
 }
 CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup);
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index b53d0de..dd7a143 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1295,7 +1295,7 @@ static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, 
u8 range,
        u64 chan_off;
        u64 dram_base           = get_dram_base(pvt, range);
        u64 hole_off            = f10_dhar_offset(pvt);
-       u64 dct_sel_base_off    = (pvt->dct_sel_hi & 0xFFFFFC00) << 16;
+       u64 dct_sel_base_off    = (u64)(pvt->dct_sel_hi & 0xFFFFFC00) << 16;
 
        if (hi_rng) {
                /*
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c 
b/drivers/gpu/drm/radeon/atombios_encoders.c
index e220554..a5b5370 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -895,8 +895,6 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int 
action, int panel_mo
                        else
                                args.v1.ucLaneNum = 4;
 
-                       if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && 
(dp_clock == 270000))
-                               args.v1.ucConfig |= 
ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
                        switch (radeon_encoder->encoder_id) {
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                                args.v1.ucConfig = 
ATOM_ENCODER_CONFIG_V2_TRANSMITTER1;
@@ -913,6 +911,10 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, 
int action, int panel_mo
                                args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB;
                        else
                                args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA;
+
+                       if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && 
(dp_clock == 270000))
+                               args.v1.ucConfig |= 
ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
+
                        break;
                case 2:
                case 3:
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 982d24d..8a0cfa0 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2453,8 +2453,10 @@ int hid_add_device(struct hid_device *hdev)
        /*
         * Scan generic devices for group information
         */
-       if (hid_ignore_special_drivers ||
-           !hid_match_id(hdev, hid_have_special_driver)) {
+       if (hid_ignore_special_drivers) {
+               hdev->group = HID_GROUP_GENERIC;
+       } else if (!hdev->group &&
+                  !hid_match_id(hdev, hid_have_special_driver)) {
                ret = hid_scan_report(hdev);
                if (ret)
                        hid_warn(hdev, "bad device descriptor (%d)\n", ret);
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 5bdef2c..744ebc1 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -267,17 +267,21 @@ static int i2c_hid_set_report(struct i2c_client *client, 
u8 reportType,
        u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
        u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);
        u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);
+       u16 size;
+       int args_len;
+       int index = 0;
+
+       i2c_hid_dbg(ihid, "%s\n", __func__);
+
+       if (data_len > ihid->bufsize)
+               return -EINVAL;
 
-       /* hidraw already checked that data_len < HID_MAX_BUFFER_SIZE */
-       u16 size =      2                       /* size */ +
+       size =          2                       /* size */ +
                        (reportID ? 1 : 0)      /* reportID */ +
                        data_len                /* buf */;
-       int args_len =  (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
+       args_len =      (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
                        2                       /* dataRegister */ +
                        size                    /* args */;
-       int index = 0;
-
-       i2c_hid_dbg(ihid, "%s\n", __func__);
 
        if (reportID >= 0x0F) {
                args[index++] = reportID;
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c 
b/drivers/infiniband/ulp/isert/ib_isert.c
index d95b14e..9d63f67 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -777,13 +777,7 @@ static int
 isert_disconnected_handler(struct rdma_cm_id *cma_id,
                           enum rdma_cm_event_type event)
 {
-       struct isert_np *isert_np = cma_id->context;
-       struct isert_conn *isert_conn;
-
-       if (isert_np->np_cm_id == cma_id)
-               return isert_np_cma_handler(cma_id->context, event);
-
-       isert_conn = cma_id->qp->qp_context;
+       struct isert_conn *isert_conn = cma_id->qp->qp_context;
 
        mutex_lock(&isert_conn->conn_mutex);
        isert_conn_terminate(isert_conn);
@@ -809,11 +803,15 @@ isert_connect_error(struct rdma_cm_id *cma_id)
 static int
 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
+       struct isert_np *isert_np = cma_id->context;
        int ret = 0;
 
        pr_debug("isert_cma_handler: event %d status %d conn %p id %p\n",
                 event->event, event->status, cma_id->context, cma_id);
 
+       if (isert_np->np_cm_id == cma_id)
+               return isert_np_cma_handler(cma_id->context, event->event);
+
        switch (event->event) {
        case RDMA_CM_EVENT_CONNECT_REQUEST:
                ret = isert_connect_request(cma_id, event);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c 
b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 206f181..36306c3 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1744,47 +1744,6 @@ send_sense:
        return -1;
 }
 
-/**
- * srpt_rx_mgmt_fn_tag() - Process a task management function by tag.
- * @ch: RDMA channel of the task management request.
- * @fn: Task management function to perform.
- * @req_tag: Tag of the SRP task management request.
- * @mgmt_ioctx: I/O context of the task management request.
- *
- * Returns zero if the target core will process the task management
- * request asynchronously.
- *
- * Note: It is assumed that the initiator serializes tag-based task management
- * requests.
- */
-static int srpt_rx_mgmt_fn_tag(struct srpt_send_ioctx *ioctx, u64 tag)
-{
-       struct srpt_device *sdev;
-       struct srpt_rdma_ch *ch;
-       struct srpt_send_ioctx *target;
-       int ret, i;
-
-       ret = -EINVAL;
-       ch = ioctx->ch;
-       BUG_ON(!ch);
-       BUG_ON(!ch->sport);
-       sdev = ch->sport->sdev;
-       BUG_ON(!sdev);
-       spin_lock_irq(&sdev->spinlock);
-       for (i = 0; i < ch->rq_size; ++i) {
-               target = ch->ioctx_ring[i];
-               if (target->cmd.se_lun == ioctx->cmd.se_lun &&
-                   target->tag == tag &&
-                   srpt_get_cmd_state(target) != SRPT_STATE_DONE) {
-                       ret = 0;
-                       /* now let the target core abort &target->cmd; */
-                       break;
-               }
-       }
-       spin_unlock_irq(&sdev->spinlock);
-       return ret;
-}
-
 static int srp_tmr_to_tcm(int fn)
 {
        switch (fn) {
@@ -1819,7 +1778,6 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch *ch,
        struct se_cmd *cmd;
        struct se_session *sess = ch->sess;
        uint64_t unpacked_lun;
-       uint32_t tag = 0;
        int tcm_tmr;
        int rc;
 
@@ -1835,25 +1793,10 @@ static void srpt_handle_tsk_mgmt(struct srpt_rdma_ch 
*ch,
        srpt_set_cmd_state(send_ioctx, SRPT_STATE_MGMT);
        send_ioctx->tag = srp_tsk->tag;
        tcm_tmr = srp_tmr_to_tcm(srp_tsk->tsk_mgmt_func);
-       if (tcm_tmr < 0) {
-               send_ioctx->cmd.se_tmr_req->response =
-                       TMR_TASK_MGMT_FUNCTION_NOT_SUPPORTED;
-               goto fail;
-       }
        unpacked_lun = srpt_unpack_lun((uint8_t *)&srp_tsk->lun,
                                       sizeof(srp_tsk->lun));
-
-       if (srp_tsk->tsk_mgmt_func == SRP_TSK_ABORT_TASK) {
-               rc = srpt_rx_mgmt_fn_tag(send_ioctx, srp_tsk->task_tag);
-               if (rc < 0) {
-                       send_ioctx->cmd.se_tmr_req->response =
-                                       TMR_TASK_DOES_NOT_EXIST;
-                       goto fail;
-               }
-               tag = srp_tsk->task_tag;
-       }
        rc = target_submit_tmr(&send_ioctx->cmd, sess, NULL, unpacked_lun,
-                               srp_tsk, tcm_tmr, GFP_KERNEL, tag,
+                               srp_tsk, tcm_tmr, GFP_KERNEL, srp_tsk->task_tag,
                                TARGET_SCF_ACK_KREF);
        if (rc != 0) {
                send_ioctx->cmd.se_tmr_req->response = TMR_FUNCTION_REJECTED;
diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
index f63341f..e8c6a48 100644
--- a/drivers/input/misc/ati_remote2.c
+++ b/drivers/input/misc/ati_remote2.c
@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface 
*interface, const struct usb_d
 
        ar2->udev = udev;
 
+       /* Sanity check, first interface must have an endpoint */
+       if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
+               dev_err(&interface->dev,
+                       "%s(): interface 0 must have an endpoint\n", __func__);
+               r = -ENODEV;
+               goto fail1;
+       }
        ar2->intf[0] = interface;
        ar2->ep[0] = &alt->endpoint[0].desc;
 
+       /* Sanity check, the device must have two interfaces */
        ar2->intf[1] = usb_ifnum_to_if(udev, 1);
+       if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
+               dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
+                       __func__, udev->actconfig->desc.bNumInterfaces);
+               r = -ENODEV;
+               goto fail1;
+       }
+
        r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
        if (r)
                goto fail1;
+
+       /* Sanity check, second interface must have an endpoint */
        alt = ar2->intf[1]->cur_altsetting;
+       if (alt->desc.bNumEndpoints < 1 || !alt->endpoint) {
+               dev_err(&interface->dev,
+                       "%s(): interface 1 must have an endpoint\n", __func__);
+               r = -ENODEV;
+               goto fail2;
+       }
        ar2->ep[1] = &alt->endpoint[0].desc;
 
        r = ati_remote2_urb_init(ar2);
        if (r)
-               goto fail2;
+               goto fail3;
 
        ar2->channel_mask = channel_mask;
        ar2->mode_mask = mode_mask;
 
        r = ati_remote2_setup(ar2, ar2->channel_mask);
        if (r)
-               goto fail2;
+               goto fail3;
 
        usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
        strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface 
*interface, const struct usb_d
 
        r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
        if (r)
-               goto fail2;
+               goto fail3;
 
        r = ati_remote2_input_init(ar2);
        if (r)
-               goto fail3;
+               goto fail4;
 
        usb_set_intfdata(interface, ar2);
 
@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface 
*interface, const struct usb_d
 
        return 0;
 
- fail3:
+ fail4:
        sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
- fail2:
+ fail3:
        ati_remote2_urb_cleanup(ar2);
+ fail2:
        usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
  fail1:
        kfree(ar2);
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index e204f26..77164dc 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1433,6 +1433,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface 
*intf, struct ims_pcu *pc
 
        pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
                                         union_desc->bMasterInterface0);
+       if (!pcu->ctrl_intf)
+               return -EINVAL;
 
        alt = pcu->ctrl_intf->cur_altsetting;
        pcu->ep_ctrl = &alt->endpoint[0].desc;
@@ -1440,6 +1442,8 @@ static int ims_pcu_parse_cdc_data(struct usb_interface 
*intf, struct ims_pcu *pc
 
        pcu->data_intf = usb_ifnum_to_if(pcu->udev,
                                         union_desc->bSlaveInterface0);
+       if (!pcu->data_intf)
+               return -EINVAL;
 
        alt = pcu->data_intf->cur_altsetting;
        if (alt->desc.bNumEndpoints != 2) {
diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
index 49c0c3e..21ce1cf 100644
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -308,6 +308,9 @@ static int powermate_probe(struct usb_interface *intf, 
const struct usb_device_i
        int error = -ENOMEM;
 
        interface = intf->cur_altsetting;
+       if (interface->desc.bNumEndpoints < 1)
+               return -EINVAL;
+
        endpoint = &interface->endpoint[0].desc;
        if (!usb_endpoint_is_int_in(endpoint))
                return -EIO;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 17b0285..189a7fd3 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -837,8 +837,9 @@ static void synaptics_report_ext_buttons(struct psmouse 
*psmouse,
        if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
                return;
 
-       /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
-       if (SYN_ID_FULL(priv->identity) == 0x801 &&
+       /* Bug in FW 8.1 & 8.2, buttons are reported only when ExtBit is 1 */
+       if ((SYN_ID_FULL(priv->identity) == 0x801 ||
+            SYN_ID_FULL(priv->identity) == 0x802) &&
            !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
                return;
 
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index a4949ce..c4044f6 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1361,6 +1361,9 @@ static void cache_set_flush(struct closure *cl)
        struct btree *b;
        unsigned i;
 
+       if (!c)
+               closure_return(cl);
+
        bch_cache_accounting_destroy(&c->accounting);
 
        kobject_put(&c->internal);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index bd9f959..c96e0a6 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6171,8 +6171,8 @@ static int run(struct mddev *mddev)
                }
 
                if (discard_supported &&
-                  mddev->queue->limits.max_discard_sectors >= stripe &&
-                  mddev->queue->limits.discard_granularity >= stripe)
+                   mddev->queue->limits.max_discard_sectors >= (stripe >> 9) &&
+                   mddev->queue->limits.discard_granularity >= stripe)
                        queue_flag_set_unlocked(QUEUE_FLAG_DISCARD,
                                                mddev->queue);
                else
diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
index 7c8d971..7199540 100644
--- a/drivers/media/i2c/adv7511.c
+++ b/drivers/media/i2c/adv7511.c
@@ -804,12 +804,23 @@ static void adv7511_dbg_dump_edid(int lvl, int debug, 
struct v4l2_subdev *sd, in
        }
 }
 
+static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
+{
+       struct adv7511_state *state = get_adv7511_state(sd);
+       struct adv7511_edid_detect ed;
+
+       /* We failed to read the EDID, so send an event for this. */
+       ed.present = false;
+       ed.segment = adv7511_rd(sd, 0xc4);
+       v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+       v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
+}
+
 static void adv7511_edid_handler(struct work_struct *work)
 {
        struct delayed_work *dwork = to_delayed_work(work);
        struct adv7511_state *state = container_of(dwork, struct adv7511_state, 
edid_handler);
        struct v4l2_subdev *sd = &state->sd;
-       struct adv7511_edid_detect ed;
 
        v4l2_dbg(1, debug, sd, "%s:\n", __func__);
 
@@ -834,9 +845,7 @@ static void adv7511_edid_handler(struct work_struct *work)
        }
 
        /* We failed to read the EDID, so send an event for this. */
-       ed.present = false;
-       ed.segment = adv7511_rd(sd, 0xc4);
-       v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+       adv7511_notify_no_edid(sd);
        v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
 }
 
@@ -907,7 +916,6 @@ static void adv7511_check_monitor_present_status(struct 
v4l2_subdev *sd)
        /* update read only ctrls */
        v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 
0x0);
        v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 
: 0x0);
-       v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 
0x0);
 
        if ((status & MASK_ADV7511_HPD_DETECT) && ((status & 
MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
                v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", 
__func__);
@@ -937,6 +945,7 @@ static void adv7511_check_monitor_present_status(struct 
v4l2_subdev *sd)
                }
                adv7511_s_power(sd, false);
                memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
+               adv7511_notify_no_edid(sd);
        }
 }
 
@@ -1000,6 +1009,7 @@ static bool adv7511_check_edid_status(struct v4l2_subdev 
*sd)
                }
                /* one more segment read ok */
                state->edid.segments = segment + 1;
+               v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
                if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) 
{
                        /* Request next EDID segment */
                        v4l2_dbg(1, debug, sd, "%s: request segment %d\n", 
__func__, state->edid.segments);
@@ -1019,7 +1029,6 @@ static bool adv7511_check_edid_status(struct v4l2_subdev 
*sd)
                ed.present = true;
                ed.segment = 0;
                state->edid_detect_counter++;
-               v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 
0x1 : 0x0);
                v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
                return ed.present;
        }
diff --git a/drivers/media/pci/bt8xx/bttv-driver.c 
b/drivers/media/pci/bt8xx/bttv-driver.c
index 92a06fd..4c5b815 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -2333,6 +2333,19 @@ static int bttv_g_fmt_vid_overlay(struct file *file, 
void *priv,
        return 0;
 }
 
+static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt,
+                                       unsigned int *width_mask,
+                                       unsigned int *width_bias)
+{
+       if (fmt->flags & FORMAT_FLAGS_PLANAR) {
+               *width_mask = ~15; /* width must be a multiple of 16 pixels */
+               *width_bias = 8;   /* nearest */
+       } else {
+               *width_mask = ~3; /* width must be a multiple of 4 pixels */
+               *width_bias = 2;  /* nearest */
+       }
+}
+
 static int bttv_try_fmt_vid_cap(struct file *file, void *priv,
                                                struct v4l2_format *f)
 {
@@ -2342,6 +2355,7 @@ static int bttv_try_fmt_vid_cap(struct file *file, void 
*priv,
        enum v4l2_field field;
        __s32 width, height;
        __s32 height2;
+       unsigned int width_mask, width_bias;
        int rc;
 
        fmt = format_by_fourcc(f->fmt.pix.pixelformat);
@@ -2374,9 +2388,9 @@ static int bttv_try_fmt_vid_cap(struct file *file, void 
*priv,
        width = f->fmt.pix.width;
        height = f->fmt.pix.height;
 
+       bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
        rc = limit_scaled_size_lock(fh, &width, &height, field,
-                              /* width_mask: 4 pixels */ ~3,
-                              /* width_bias: nearest */ 2,
+                              width_mask, width_bias,
                               /* adjust_size */ 1,
                               /* adjust_crop */ 0);
        if (0 != rc)
@@ -2409,6 +2423,7 @@ static int bttv_s_fmt_vid_cap(struct file *file, void 
*priv,
        struct bttv_fh *fh = priv;
        struct bttv *btv = fh->btv;
        __s32 width, height;
+       unsigned int width_mask, width_bias;
        enum v4l2_field field;
 
        retval = bttv_switch_type(fh, f->type);
@@ -2423,9 +2438,10 @@ static int bttv_s_fmt_vid_cap(struct file *file, void 
*priv,
        height = f->fmt.pix.height;
        field = f->fmt.pix.field;
 
+       fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+       bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias);
        retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field,
-                              /* width_mask: 4 pixels */ ~3,
-                              /* width_bias: nearest */ 2,
+                              width_mask, width_bias,
                               /* adjust_size */ 1,
                               /* adjust_crop */ 1);
        if (0 != retval)
@@ -2433,8 +2449,6 @@ static int bttv_s_fmt_vid_cap(struct file *file, void 
*priv,
 
        f->fmt.pix.field = field;
 
-       fmt = format_by_fourcc(f->fmt.pix.pixelformat);
-
        /* update our state informations */
        fh->fmt              = fmt;
        fh->cap.field        = f->fmt.pix.field;
diff --git a/drivers/media/pci/saa7134/saa7134-video.c 
b/drivers/media/pci/saa7134/saa7134-video.c
index fb60da8..d11fdfb 100644
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1562,10 +1562,13 @@ static int saa7134_g_fmt_vid_cap(struct file *file, 
void *priv,
        f->fmt.pix.height       = dev->height;
        f->fmt.pix.field        = fh->cap.field;
        f->fmt.pix.pixelformat  = dev->fmt->fourcc;
-       f->fmt.pix.bytesperline =
-               (f->fmt.pix.width * dev->fmt->depth) >> 3;
+       if (dev->fmt->planar)
+               f->fmt.pix.bytesperline = f->fmt.pix.width;
+       else
+               f->fmt.pix.bytesperline =
+                       (f->fmt.pix.width * dev->fmt->depth) / 8;
        f->fmt.pix.sizeimage =
-               f->fmt.pix.height * f->fmt.pix.bytesperline;
+               (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8;
        f->fmt.pix.colorspace   = V4L2_COLORSPACE_SMPTE170M;
        f->fmt.pix.priv = 0;
        return 0;
@@ -1646,10 +1649,13 @@ static int saa7134_try_fmt_vid_cap(struct file *file, 
void *priv,
        if (f->fmt.pix.height > maxh)
                f->fmt.pix.height = maxh;
        f->fmt.pix.width &= ~0x03;
-       f->fmt.pix.bytesperline =
-               (f->fmt.pix.width * fmt->depth) >> 3;
+       if (fmt->planar)
+               f->fmt.pix.bytesperline = f->fmt.pix.width;
+       else
+               f->fmt.pix.bytesperline =
+                       (f->fmt.pix.width * fmt->depth) / 8;
        f->fmt.pix.sizeimage =
-               f->fmt.pix.height * f->fmt.pix.bytesperline;
+               (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8;
        f->fmt.pix.colorspace   = V4L2_COLORSPACE_SMPTE170M;
        f->fmt.pix.priv = 0;
 
diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c
index 78c9bc8..cf1f2c2 100644
--- a/drivers/media/usb/pwc/pwc-if.c
+++ b/drivers/media/usb/pwc/pwc-if.c
@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_device_table [] = {
        { USB_DEVICE(0x0471, 0x0312) },
        { USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */
        { USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */
+       { USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */
        { USB_DEVICE(0x069A, 0x0001) }, /* Askey */
        { USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */
        { USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */
@@ -799,6 +800,11 @@ static int usb_pwc_probe(struct usb_interface *intf, const 
struct usb_device_id
                        name = "Philips SPC 900NC webcam";
                        type_id = 740;
                        break;
+               case 0x032C:
+                       PWC_INFO("Philips SPC 880NC USB webcam detected.\n");
+                       name = "Philips SPC 880NC webcam";
+                       type_id = 740;
+                       break;
                default:
                        return -ENODEV;
                        break;
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c 
b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 3805f82..e007645 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct 
v4l2_buffer32 __user
                get_user(kp->index, &up->index) ||
                get_user(kp->type, &up->type) ||
                get_user(kp->flags, &up->flags) ||
-               get_user(kp->memory, &up->memory))
+               get_user(kp->memory, &up->memory) ||
+               get_user(kp->length, &up->length))
                        return -EFAULT;
 
        if (V4L2_TYPE_IS_OUTPUT(kp->type))
@@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct 
v4l2_buffer32 __user
                        return -EFAULT;
 
        if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
-               if (get_user(kp->length, &up->length))
-                       return -EFAULT;
-
                num_planes = kp->length;
                if (num_planes == 0) {
                        kp->m.planes = NULL;
@@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, 
struct v4l2_buffer32 __user
        } else {
                switch (kp->memory) {
                case V4L2_MEMORY_MMAP:
-                       if (get_user(kp->length, &up->length) ||
-                               get_user(kp->m.offset, &up->m.offset))
+                       if (get_user(kp->m.offset, &up->m.offset))
                                return -EFAULT;
                        break;
                case V4L2_MEMORY_USERPTR:
                        {
                        compat_long_t tmp;
 
-                       if (get_user(kp->length, &up->length) ||
-                           get_user(tmp, &up->m.userptr))
+                       if (get_user(tmp, &up->m.userptr))
                                return -EFAULT;
 
                        kp->m.userptr = (unsigned long)compat_ptr(tmp);
@@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct 
v4l2_buffer32 __user
                copy_to_user(&up->timecode, &kp->timecode, sizeof(struct 
v4l2_timecode)) ||
                put_user(kp->sequence, &up->sequence) ||
                put_user(kp->reserved2, &up->reserved2) ||
-               put_user(kp->reserved, &up->reserved))
+               put_user(kp->reserved, &up->reserved) ||
+               put_user(kp->length, &up->length))
                        return -EFAULT;
 
        if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
@@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, 
struct v4l2_buffer32 __user
        } else {
                switch (kp->memory) {
                case V4L2_MEMORY_MMAP:
-                       if (put_user(kp->length, &up->length) ||
-                               put_user(kp->m.offset, &up->m.offset))
+                       if (put_user(kp->m.offset, &up->m.offset))
                                return -EFAULT;
                        break;
                case V4L2_MEMORY_USERPTR:
-                       if (put_user(kp->length, &up->length) ||
-                               put_user(kp->m.userptr, &up->m.userptr))
+                       if (put_user(kp->m.userptr, &up->m.userptr))
                                return -EFAULT;
                        break;
                case V4L2_MEMORY_OVERLAY:
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a3e291d..747abb5 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -438,7 +438,7 @@ config ARM_CHARLCD
          still useful.
 
 config BMP085
-       bool
+       tristate
        depends on SYSFS
 
 config BMP085_I2C
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index 0daadcf..65fb744 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_data *dpot, u8 reg)
                         */
                        value = swab16(value);
 
-                       if (dpot->uid == DPOT_UID(AD5271_ID))
+                       if (dpot->uid == DPOT_UID(AD5274_ID))
                                value = value >> 2;
                return value;
        default:
diff --git a/drivers/mtd/onenand/onenand_base.c 
b/drivers/mtd/onenand/onenand_base.c
index 1de33b5..fdfde02 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -2606,6 +2606,7 @@ static int onenand_default_block_markbad(struct mtd_info 
*mtd, loff_t ofs)
  */
 static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
 {
+       struct onenand_chip *this = mtd->priv;
        int ret;
 
        ret = onenand_block_isbad(mtd, ofs);
@@ -2617,7 +2618,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, 
loff_t ofs)
        }
 
        onenand_get_device(mtd, FL_WRITING);
-       ret = mtd_block_markbad(mtd, ofs);
+       ret = this->block_markbad(mtd, ofs);
        onenand_release_device(mtd);
        return ret;
 }
diff --git a/drivers/net/ethernet/marvell/mvneta.c 
b/drivers/net/ethernet/marvell/mvneta.c
index 35db1de..200555c 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -2894,7 +2894,7 @@ static int mvneta_probe(struct platform_device *pdev)
        dev->features = NETIF_F_SG | NETIF_F_IP_CSUM;
        dev->hw_features |= NETIF_F_SG | NETIF_F_IP_CSUM;
        dev->vlan_features |= NETIF_F_SG | NETIF_F_IP_CSUM;
-       dev->priv_flags |= IFF_UNICAST_FLT;
+       dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
 
        err = register_netdev(dev);
        if (err < 0) {
diff --git a/drivers/net/ethernet/micrel/ks8842.c 
b/drivers/net/ethernet/micrel/ks8842.c
index 822616e..64c92b6 100644
--- a/drivers/net/ethernet/micrel/ks8842.c
+++ b/drivers/net/ethernet/micrel/ks8842.c
@@ -561,8 +561,8 @@ static int __ks8842_start_new_rx_dma(struct net_device 
*netdev)
                sg_init_table(sg, 1);
                sg_dma_address(sg) = dma_map_single(adapter->dev,
                        ctl->skb->data, DMA_BUFFER_SIZE, DMA_FROM_DEVICE);
-               err = dma_mapping_error(adapter->dev, sg_dma_address(sg));
-               if (unlikely(err)) {
+               if (dma_mapping_error(adapter->dev, sg_dma_address(sg))) {
+                       err = -ENOMEM;
                        sg_dma_address(sg) = 0;
                        goto out;
                }
@@ -572,8 +572,10 @@ static int __ks8842_start_new_rx_dma(struct net_device 
*netdev)
                ctl->adesc = dmaengine_prep_slave_sg(ctl->chan,
                        sg, 1, DMA_DEV_TO_MEM, DMA_PREP_INTERRUPT);
 
-               if (!ctl->adesc)
+               if (!ctl->adesc) {
+                       err = -ENOMEM;
                        goto out;
+               }
 
                ctl->adesc->callback_param = netdev;
                ctl->adesc->callback = ks8842_dma_rx_cb;
@@ -584,7 +586,7 @@ static int __ks8842_start_new_rx_dma(struct net_device 
*netdev)
                goto out;
        }
 
-       return err;
+       return 0;
 out:
        if (sg_dma_address(sg))
                dma_unmap_single(adapter->dev, sg_dma_address(sg),
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 177441a..aef74c6 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct *tty)
 
        /* Module stuff handled via irda_ldisc.owner - Jean II */
 
-       /* First make sure we're not already connected. */
-       if (tty->disc_data != NULL) {
-               priv = tty->disc_data;
-               if (priv && priv->magic == IRTTY_MAGIC) {
-                       ret = -EEXIST;
-                       goto out;
-               }
-               tty->disc_data = NULL;          /* ### */
-       }
-
        /* stop the underlying  driver */
        irtty_stop_receiver(tty, TRUE);
        if (tty->ops->stop)
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index 18969b3..1d76c1b 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -139,6 +139,7 @@ static int sun4i_mdio_probe(struct platform_device *pdev)
                        return -EPROBE_DEFER;
 
                dev_info(&pdev->dev, "no regulator found\n");
+               data->regulator = NULL;
        } else {
                ret = regulator_enable(data->regulator);
                if (ret)
@@ -154,7 +155,8 @@ static int sun4i_mdio_probe(struct platform_device *pdev)
        return 0;
 
 err_out_disable_regulator:
-       regulator_disable(data->regulator);
+       if (data->regulator)
+               regulator_disable(data->regulator);
 err_out_free_mdiobus:
        mdiobus_free(bus);
        return ret;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index a2d7d5f..bf45a0c 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -568,7 +568,7 @@ static int get_filter(void __user *arg, struct sock_filter 
**p)
 
 static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-       struct ppp_file *pf = file->private_data;
+       struct ppp_file *pf;
        struct ppp *ppp;
        int err = -EFAULT, val, val2, i;
        struct ppp_idle idle;
@@ -578,9 +578,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, 
unsigned long arg)
        void __user *argp = (void __user *)arg;
        int __user *p = argp;
 
-       if (!pf)
-               return ppp_unattached_ioctl(current->nsproxy->net_ns,
-                                       pf, file, cmd, arg);
+       mutex_lock(&ppp_mutex);
+
+       pf = file->private_data;
+       if (!pf) {
+               err = ppp_unattached_ioctl(current->nsproxy->net_ns,
+                                          pf, file, cmd, arg);
+               goto out;
+       }
 
        if (cmd == PPPIOCDETACH) {
                /*
@@ -595,7 +600,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, 
unsigned long arg)
                 * this fd and reopening /dev/ppp.
                 */
                err = -EINVAL;
-               mutex_lock(&ppp_mutex);
                if (pf->kind == INTERFACE) {
                        ppp = PF_TO_PPP(pf);
                        if (file == ppp->owner)
@@ -607,15 +611,13 @@ static long ppp_ioctl(struct file *file, unsigned int 
cmd, unsigned long arg)
                } else
                        pr_warn("PPPIOCDETACH file->f_count=%ld\n",
                                atomic_long_read(&file->f_count));
-               mutex_unlock(&ppp_mutex);
-               return err;
+               goto out;
        }
 
        if (pf->kind == CHANNEL) {
                struct channel *pch;
                struct ppp_channel *chan;
 
-               mutex_lock(&ppp_mutex);
                pch = PF_TO_CHANNEL(pf);
 
                switch (cmd) {
@@ -637,17 +639,16 @@ static long ppp_ioctl(struct file *file, unsigned int 
cmd, unsigned long arg)
                                err = chan->ops->ioctl(chan, cmd, arg);
                        up_read(&pch->chan_sem);
                }
-               mutex_unlock(&ppp_mutex);
-               return err;
+               goto out;
        }
 
        if (pf->kind != INTERFACE) {
                /* can't happen */
                pr_err("PPP: not interface or channel??\n");
-               return -EINVAL;
+               err = -EINVAL;
+               goto out;
        }
 
-       mutex_lock(&ppp_mutex);
        ppp = PF_TO_PPP(pf);
        switch (cmd) {
        case PPPIOCSMRU:
@@ -794,7 +795,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, 
unsigned long arg)
        default:
                err = -ENOTTY;
        }
+
+out:
        mutex_unlock(&ppp_mutex);
+
        return err;
 }
 
@@ -807,7 +811,6 @@ static int ppp_unattached_ioctl(struct net *net, struct 
ppp_file *pf,
        struct ppp_net *pn;
        int __user *p = (int __user *)arg;
 
-       mutex_lock(&ppp_mutex);
        switch (cmd) {
        case PPPIOCNEWUNIT:
                /* Create a new ppp unit */
@@ -858,7 +861,7 @@ static int ppp_unattached_ioctl(struct net *net, struct 
ppp_file *pf,
        default:
                err = -ENOTTY;
        }
-       mutex_unlock(&ppp_mutex);
+
        return err;
 }
 
@@ -2220,7 +2223,7 @@ int ppp_register_net_channel(struct net *net, struct 
ppp_channel *chan)
 
        pch->ppp = NULL;
        pch->chan = chan;
-       pch->chan_net = net;
+       pch->chan_net = get_net(net);
        chan->ppp = pch;
        init_ppp_file(&pch->file, CHANNEL);
        pch->file.hdrlen = chan->hdrlen;
@@ -2317,6 +2320,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
        spin_lock_bh(&pn->all_channels_lock);
        list_del(&pch->list);
        spin_unlock_bh(&pn->all_channels_lock);
+       put_net(pch->chan_net);
+       pch->chan_net = NULL;
 
        pch->file.dead = 1;
        wake_up_interruptible(&pch->file.rwait);
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 6d1f6ed..d93bac1 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -280,7 +280,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, 
void *dev_id, int mbo
        struct net_device *ndev = dev_id;
        struct rionet_private *rnet = netdev_priv(ndev);
 
-       spin_lock(&rnet->lock);
+       spin_lock(&rnet->tx_lock);
 
        if (netif_msg_intr(rnet))
                printk(KERN_INFO
@@ -299,7 +299,7 @@ static void rionet_outb_msg_event(struct rio_mport *mport, 
void *dev_id, int mbo
        if (rnet->tx_cnt < RIONET_TX_RING_SIZE)
                netif_wake_queue(ndev);
 
-       spin_unlock(&rnet->lock);
+       spin_unlock(&rnet->tx_lock);
 }
 
 static int rionet_open(struct net_device *ndev)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c 
b/drivers/net/wireless/ath/ath9k/eeprom.c
index 971d770..2ac0548 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -408,10 +408,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
 
        if (match) {
                if (AR_SREV_9287(ah)) {
-                       /* FIXME: array overrun? */
                        for (i = 0; i < numXpdGains; i++) {
                                minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
-                               maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
+                               maxPwrT4[i] = 
data_9287[idxL].pwrPdg[i][intercepts - 1];
                                ath9k_hw_fill_vpd_table(minPwrT4[i], 
maxPwrT4[i],
                                                data_9287[idxL].pwrPdg[i],
                                                data_9287[idxL].vpdPdg[i],
@@ -421,7 +420,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
                } else if (eeprom_4k) {
                        for (i = 0; i < numXpdGains; i++) {
                                minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
-                               maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
+                               maxPwrT4[i] = 
data_4k[idxL].pwrPdg[i][intercepts - 1];
                                ath9k_hw_fill_vpd_table(minPwrT4[i], 
maxPwrT4[i],
                                                data_4k[idxL].pwrPdg[i],
                                                data_4k[idxL].vpdPdg[i],
@@ -431,7 +430,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
                } else {
                        for (i = 0; i < numXpdGains; i++) {
                                minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
-                               maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
+                               maxPwrT4[i] = 
data_def[idxL].pwrPdg[i][intercepts - 1];
                                ath9k_hw_fill_vpd_table(minPwrT4[i], 
maxPwrT4[i],
                                                data_def[idxL].pwrPdg[i],
                                                data_def[idxL].vpdPdg[i],
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c 
b/drivers/net/wireless/rt2x00/rt2800usb.c
index 24da6e8..6c612a2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x0411, 0x01a2) },
        { USB_DEVICE(0x0411, 0x01ee) },
        { USB_DEVICE(0x0411, 0x01a8) },
+       { USB_DEVICE(0x0411, 0x01fd) },
        /* Corega */
        { USB_DEVICE(0x07aa, 0x002f) },
        { USB_DEVICE(0x07aa, 0x003c) },
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index ef18351..aa54d68 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -175,6 +175,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type 
type,
        struct pci_bus_region region, inverted_region;
        bool bar_too_big = false, bar_disabled = false;
 
+       if (dev->non_compliant_bars)
+               return 0;
+
        mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
 
        /* No printks while decoding is disabled! */
@@ -1017,6 +1020,7 @@ void set_pcie_hotplug_bridge(struct pci_dev *pdev)
 int pci_setup_device(struct pci_dev *dev)
 {
        u32 class;
+       u16 cmd;
        u8 hdr_type;
        struct pci_slot *slot;
        int pos = 0;
@@ -1064,6 +1068,16 @@ int pci_setup_device(struct pci_dev *dev)
        /* device class may be changed after fixup */
        class = dev->class >> 8;
 
+       if (dev->non_compliant_bars) {
+               pci_read_config_word(dev, PCI_COMMAND, &cmd);
+               if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
+                       dev_info(&dev->dev, "device has non-compliant BARs; 
disabling IO/MEM decoding\n");
+                       cmd &= ~PCI_COMMAND_IO;
+                       cmd &= ~PCI_COMMAND_MEMORY;
+                       pci_write_config_word(dev, PCI_COMMAND, cmd);
+               }
+       }
+
        switch (dev->hdr_type) {                    /* header type */
        case PCI_HEADER_TYPE_NORMAL:                /* standard header */
                if (class == PCI_CLASS_BRIDGE_PCI)
diff --git a/drivers/pinctrl/pinctrl-bcm2835.c 
b/drivers/pinctrl/pinctrl-bcm2835.c
index b469383..d971582 100644
--- a/drivers/pinctrl/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/pinctrl-bcm2835.c
@@ -779,7 +779,7 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev 
*pctldev,
                }
                if (num_pulls) {
                        err = of_property_read_u32_index(np, "brcm,pull",
-                                       (num_funcs > 1) ? i : 0, &pull);
+                                       (num_pulls > 1) ? i : 0, &pull);
                        if (err)
                                goto out;
                        err = bcm2835_pctl_dt_node_to_map_pull(pc, np, pin,
diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
index aabc22c..73dcc9a 100644
--- a/drivers/rtc/rtc-vr41xx.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -272,12 +272,13 @@ static irqreturn_t rtclong1_interrupt(int irq, void 
*dev_id)
 }
 
 static const struct rtc_class_ops vr41xx_rtc_ops = {
-       .release        = vr41xx_rtc_release,
-       .ioctl          = vr41xx_rtc_ioctl,
-       .read_time      = vr41xx_rtc_read_time,
-       .set_time       = vr41xx_rtc_set_time,
-       .read_alarm     = vr41xx_rtc_read_alarm,
-       .set_alarm      = vr41xx_rtc_set_alarm,
+       .release                = vr41xx_rtc_release,
+       .ioctl                  = vr41xx_rtc_ioctl,
+       .read_time              = vr41xx_rtc_read_time,
+       .set_time               = vr41xx_rtc_set_time,
+       .read_alarm             = vr41xx_rtc_read_alarm,
+       .set_alarm              = vr41xx_rtc_set_alarm,
+       .alarm_irq_enable       = vr41xx_rtc_alarm_irq_enable,
 };
 
 static int rtc_probe(struct platform_device *pdev)
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index cab190a..6b32ddc 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_dev *dev)
 
 void aac_fib_map_free(struct aac_dev *dev)
 {
-       pci_free_consistent(dev->pdev,
-         dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB),
-         dev->hw_fib_va, dev->hw_fib_pa);
+       if (dev->hw_fib_va && dev->max_fib_size) {
+               pci_free_consistent(dev->pdev,
+               (dev->max_fib_size *
+               (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)),
+               dev->hw_fib_va, dev->hw_fib_pa);
+       }
        dev->hw_fib_va = NULL;
        dev->hw_fib_pa = 0;
 }
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 4fbc8db5..1e02098 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -4432,6 +4432,7 @@ put_shost:
        scsi_host_put(phba->shost);
 free_kset:
        iscsi_boot_destroy_kset(phba->boot_kset);
+       phba->boot_kset = NULL;
        return -ENOMEM;
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 68c94cc..39dc1d4 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -2697,7 +2697,7 @@ lpfc_online(struct lpfc_hba *phba)
        }
 
        vports = lpfc_create_vport_work_array(phba);
-       if (vports != NULL)
+       if (vports != NULL) {
                for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
                        struct Scsi_Host *shost;
                        shost = lpfc_shost_from_vport(vports[i]);
@@ -2714,7 +2714,8 @@ lpfc_online(struct lpfc_hba *phba)
                        }
                        spin_unlock_irq(shost->host_lock);
                }
-               lpfc_destroy_vport_work_array(phba, vports);
+       }
+       lpfc_destroy_vport_work_array(phba, vports);
 
        lpfc_unblock_mgmt_io(phba);
        return 0;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0be16bf..1f65e32 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -633,7 +633,8 @@ sg_write(struct file *filp, const char __user *buf, size_t 
count, loff_t * ppos)
        else
                hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : 
SG_DXFER_NONE;
        hp->dxfer_len = mxsize;
-       if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+       if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
+           (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
                hp->dxferp = (char __user *)buf + cmd_size;
        else
                hp->dxferp = NULL;
diff --git a/drivers/target/target_core_transport.c 
b/drivers/target/target_core_transport.c
index 8430a15..f02edee 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2446,8 +2446,6 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 
        list_for_each_entry_safe(se_cmd, tmp_cmd,
                                &se_sess->sess_wait_list, se_cmd_list) {
-               list_del_init(&se_cmd->se_cmd_list);
-
                pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
                        " %d\n", se_cmd, se_cmd->t_state,
                        se_cmd->se_tfo->get_cmd_state(se_cmd));
diff --git a/drivers/tty/serial/8250/8250_core.c 
b/drivers/tty/serial/8250/8250_core.c
index 78abb19..19ef131 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -686,22 +686,16 @@ static int size_fifo(struct uart_8250_port *up)
  */
 static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p)
 {
-       unsigned char old_dll, old_dlm, old_lcr;
-       unsigned int id;
+       unsigned char old_lcr;
+       unsigned int id, old_dl;
 
        old_lcr = serial_in(p, UART_LCR);
        serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A);
+       old_dl = serial_dl_read(p);
+       serial_dl_write(p, 0);
+       id = serial_dl_read(p);
+       serial_dl_write(p, old_dl);
 
-       old_dll = serial_in(p, UART_DLL);
-       old_dlm = serial_in(p, UART_DLM);
-
-       serial_out(p, UART_DLL, 0);
-       serial_out(p, UART_DLM, 0);
-
-       id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8;
-
-       serial_out(p, UART_DLL, old_dll);
-       serial_out(p, UART_DLM, old_dlm);
        serial_out(p, UART_LCR, old_lcr);
 
        return id;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 81edbac..c321fb8 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -961,6 +961,9 @@ static int acm_probe(struct usb_interface *intf,
        if (quirks == NO_UNION_NORMAL) {
                data_interface = usb_ifnum_to_if(usb_dev, 1);
                control_interface = usb_ifnum_to_if(usb_dev, 0);
+               /* we would crash */
+               if (!data_interface || !control_interface)
+                       return -ENODEV;
                goto skip_normal_probe;
        }
 
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index f573c1d..bcbceec 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -463,11 +463,15 @@ static int usb_unbind_interface(struct device *dev)
 int usb_driver_claim_interface(struct usb_driver *driver,
                                struct usb_interface *iface, void *priv)
 {
-       struct device *dev = &iface->dev;
+       struct device *dev;
        struct usb_device *udev;
        int retval = 0;
        int lpm_disable_error;
 
+       if (!iface)
+               return -ENODEV;
+
+       dev = &iface->dev;
        if (dev->driver)
                return -EBUSY;
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 3a2960f..c28cb53 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4193,7 +4193,13 @@ hub_port_init (struct usb_hub *hub, struct usb_device 
*udev, int port1,
                                                r = -EPROTO;
                                        break;
                                }
-                               if (r == 0)
+                               /*
+                                * Some devices time out if they are powered on
+                                * when already connected. They need a second
+                                * reset. But only on the first attempt,
+                                * lest we get into a time out/reset loop
+                                */
+                               if (r == 0  || (r == -ETIMEDOUT && j == 0))
                                        break;
                        }
                        udev->descriptor.bMaxPacketSize0 =
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index d36f34e..4c24ba0 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -792,6 +792,12 @@ static int iowarrior_probe(struct usb_interface *interface,
        iface_desc = interface->cur_altsetting;
        dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
+       if (iface_desc->desc.bNumEndpoints < 1) {
+               dev_err(&interface->dev, "Invalid number of endpoints\n");
+               retval = -EINVAL;
+               goto error;
+       }
+
        /* set up the endpoint information */
        for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                endpoint = &iface_desc->endpoint[i].desc;
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index d966b59..11b40a1 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -835,7 +835,7 @@ static struct scsi_host_template uas_host_template = {
        .eh_abort_handler = uas_eh_abort_handler,
        .eh_device_reset_handler = uas_eh_device_reset_handler,
        .eh_bus_reset_handler = uas_eh_bus_reset_handler,
-       .can_queue = 65536,     /* Is there a limit on the _host_ ? */
+       .can_queue = MAX_CMNDS,
        .this_id = -1,
        .sg_tablesize = SG_NONE,
        .cmd_per_lun = 1,       /* until we override it */
diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c
index 71e78ef..3a75f3b 100644
--- a/drivers/watchdog/rc32434_wdt.c
+++ b/drivers/watchdog/rc32434_wdt.c
@@ -237,7 +237,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned 
int cmd,
                        return -EINVAL;
                /* Fall through */
        case WDIOC_GETTIMEOUT:
-               return copy_to_user(argp, &timeout, sizeof(int));
+               return copy_to_user(argp, &timeout, sizeof(int)) ? -EFAULT : 0;
        default:
                return -ENOTTY;
        }
diff --git a/fs/coredump.c b/fs/coredump.c
index c28bcd2..49fc755 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -32,6 +32,9 @@
 #include <linux/pipe_fs_i.h>
 #include <linux/oom.h>
 #include <linux/compat.h>
+#include <linux/sched.h>
+#include <linux/fs.h>
+#include <linux/path.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -614,6 +617,8 @@ void do_coredump(const siginfo_t *siginfo)
                }
        } else {
                struct inode *inode;
+               int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
+                                O_LARGEFILE | O_EXCL;
 
                if (cprm.limit < binfmt->min_coredump)
                        goto fail_unlock;
@@ -652,10 +657,27 @@ void do_coredump(const siginfo_t *siginfo)
                 * what matters is that at least one of the two processes
                 * writes its coredump successfully, not which one.
                 */
-               cprm.file = filp_open(cn.corename,
-                                O_CREAT | 2 | O_NOFOLLOW |
-                                O_LARGEFILE | O_EXCL,
-                                0600);
+               if (need_suid_safe) {
+                       /*
+                        * Using user namespaces, normal user tasks can change
+                        * their current->fs->root to point to arbitrary
+                        * directories. Since the intention of the "only dump
+                        * with a fully qualified path" rule is to control where
+                        * coredumps may be placed using root privileges,
+                        * current->fs->root must not be used. Instead, use the
+                        * root directory of init_task.
+                        */
+                       struct path root;
+
+                       task_lock(&init_task);
+                       get_fs_root(init_task.fs, &root);
+                       task_unlock(&init_task);
+                       cprm.file = file_open_root(root.dentry, root.mnt,
+                               cn.corename, open_flags, 0600);
+                       path_put(&root);
+               } else {
+                       cprm.file = filp_open(cn.corename, open_flags, 0600);
+               }
                if (IS_ERR(cprm.file))
                        goto fail_unlock;
 
diff --git a/fs/fhandle.c b/fs/fhandle.c
index d59712d..ca3c3dd 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd,
                path_put(&path);
                return fd;
        }
-       file = file_open_root(path.dentry, path.mnt, "", open_flag);
+       file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
        if (IS_ERR(file)) {
                put_unused_fd(fd);
                retval =  PTR_ERR(file);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index ef5f39a..84db6c7 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1423,11 +1423,12 @@ out:
 /**
  * jbd2_mark_journal_empty() - Mark on disk journal as empty.
  * @journal: The journal to update.
+ * @write_op: With which operation should we write the journal sb
  *
  * Update a journal's dynamic superblock fields to show that journal is empty.
  * Write updated superblock to disk waiting for IO to complete.
  */
-static void jbd2_mark_journal_empty(journal_t *journal)
+static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
 {
        journal_superblock_t *sb = journal->j_superblock;
 
@@ -1445,7 +1446,7 @@ static void jbd2_mark_journal_empty(journal_t *journal)
        sb->s_start    = cpu_to_be32(0);
        read_unlock(&journal->j_state_lock);
 
-       jbd2_write_superblock(journal, WRITE_FUA);
+       jbd2_write_superblock(journal, write_op);
 
        /* Log is no longer empty */
        write_lock(&journal->j_state_lock);
@@ -1730,7 +1731,13 @@ int jbd2_journal_destroy(journal_t *journal)
        if (journal->j_sb_buffer) {
                if (!is_journal_aborted(journal)) {
                        mutex_lock(&journal->j_checkpoint_mutex);
-                       jbd2_mark_journal_empty(journal);
+
+                       write_lock(&journal->j_state_lock);
+                       journal->j_tail_sequence =
+                               ++journal->j_transaction_sequence;
+                       write_unlock(&journal->j_state_lock);
+
+                       jbd2_mark_journal_empty(journal, WRITE_FLUSH_FUA);
                        mutex_unlock(&journal->j_checkpoint_mutex);
                } else
                        err = -EIO;
@@ -1991,7 +1998,7 @@ int jbd2_journal_flush(journal_t *journal)
         * the magic code for a fully-recovered superblock.  Any future
         * commits of data to the journal will restore the current
         * s_start value. */
-       jbd2_mark_journal_empty(journal);
+       jbd2_mark_journal_empty(journal, WRITE_FUA);
        mutex_unlock(&journal->j_checkpoint_mutex);
        write_lock(&journal->j_state_lock);
        J_ASSERT(!journal->j_running_transaction);
@@ -2037,7 +2044,7 @@ int jbd2_journal_wipe(journal_t *journal, int write)
        if (write) {
                /* Lock to make assertions happy... */
                mutex_lock(&journal->j_checkpoint_mutex);
-               jbd2_mark_journal_empty(journal);
+               jbd2_mark_journal_empty(journal, WRITE_FUA);
                mutex_unlock(&journal->j_checkpoint_mutex);
        }
 
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 25024d5..9cdd0b2 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -877,6 +877,7 @@ nfsd4_secinfo(struct svc_rqst *rqstp, struct 
nfsd4_compound_state *cstate,
                                    &exp, &dentry);
        if (err)
                return err;
+       fh_unlock(&cstate->current_fh);
        if (dentry->d_inode == NULL) {
                exp_put(exp);
                err = nfserr_noent;
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index e36d63f..f909313 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -262,6 +262,7 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                                  struct dlm_lock *lock, int flags, int type)
 {
        enum dlm_status status;
+       u8 old_owner = res->owner;
 
        mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
             lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
@@ -287,6 +288,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                status = DLM_DENIED;
                goto bail;
        }
+
+       if (lock->ml.type == type && lock->ml.convert_type == LKM_IVMODE) {
+               mlog(0, "last convert request returned DLM_RECOVERING, but "
+                    "owner has already queued and sent ast to me. res %.*s, "
+                    "(cookie=%u:%llu, type=%d, conv=%d)\n",
+                    res->lockname.len, res->lockname.name,
+                    dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
+                    dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
+                    lock->ml.type, lock->ml.convert_type);
+               status = DLM_NORMAL;
+               goto bail;
+       }
+
        res->state |= DLM_LOCK_RES_IN_PROGRESS;
        /* move lock to local convert queue */
        /* do not alter lock refcount.  switching lists. */
@@ -316,11 +330,19 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
        spin_lock(&res->spinlock);
        res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
        lock->convert_pending = 0;
-       /* if it failed, move it back to granted queue */
+       /* if it failed, move it back to granted queue.
+        * if master returns DLM_NORMAL and then down before sending ast,
+        * it may have already been moved to granted queue, reset to
+        * DLM_RECOVERING and retry convert */
        if (status != DLM_NORMAL) {
                if (status != DLM_NOTQUEUED)
                        dlm_error(status);
                dlm_revert_pending_convert(res, lock);
+       } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
+                       (old_owner != res->owner)) {
+               mlog(0, "res %.*s is in recovering or has been recovered.\n",
+                               res->lockname.len, res->lockname.name);
+               status = DLM_RECOVERING;
        }
 bail:
        spin_unlock(&res->spinlock);
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 4b93d96..01be4e4 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -2040,7 +2040,6 @@ void dlm_move_lockres_to_recovery_list(struct dlm_ctxt 
*dlm,
                        dlm_lock_get(lock);
                        if (lock->convert_pending) {
                                /* move converting lock back to granted */
-                               BUG_ON(i != DLM_CONVERTING_LIST);
                                mlog(0, "node died with convert pending "
                                     "on %.*s. move back to granted list.\n",
                                     res->lockname.len, res->lockname.name);
diff --git a/fs/open.c b/fs/open.c
index 2855a16..69e680d 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -941,14 +941,12 @@ struct file *filp_open(const char *filename, int flags, 
umode_t mode)
 EXPORT_SYMBOL(filp_open);
 
 struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt,
-                           const char *filename, int flags)
+                           const char *filename, int flags, umode_t mode)
 {
        struct open_flags op;
-       int err = build_open_flags(flags, 0, &op);
+       int err = build_open_flags(flags, mode, &op);
        if (err)
                return ERR_PTR(err);
-       if (flags & O_CREAT)
-               return ERR_PTR(-EINVAL);
        if (!filename && (flags & O_DIRECTORY))
                if (!dentry->d_inode->i_op->lookup)
                        return ERR_PTR(-ENOTDIR);
diff --git a/fs/pipe.c b/fs/pipe.c
index 47f79ac..c281867 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -407,6 +407,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
                        void *addr;
                        size_t chars = buf->len, remaining;
                        int error, atomic;
+                       int offset;
 
                        if (chars > total_len)
                                chars = total_len;
@@ -420,9 +421,10 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 
                        atomic = !iov_fault_in_pages_write(iov, chars);
                        remaining = chars;
+                       offset = buf->offset;
 redo:
                        addr = ops->map(pipe, buf, atomic);
-                       error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
+                       error = pipe_iov_copy_to_user(iov, addr, &offset,
                                                      &remaining, atomic);
                        ops->unmap(pipe, buf, addr);
                        if (unlikely(error)) {
@@ -438,6 +440,7 @@ redo:
                                break;
                        }
                        ret += chars;
+                       buf->offset += chars;
                        buf->len -= chars;
 
                        /* Was it a packet buffer? Clean up and exit */
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 064e9eb..995b90f 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1403,7 +1403,7 @@ static int dquot_active(const struct inode *inode)
 static void __dquot_initialize(struct inode *inode, int type)
 {
        int cnt;
-       struct dquot *got[MAXQUOTAS];
+       struct dquot *got[MAXQUOTAS] = {};
        struct super_block *sb = inode->i_sb;
        qsize_t rsv;
 
@@ -1415,7 +1415,6 @@ static void __dquot_initialize(struct inode *inode, int 
type)
        /* First get references to structures we might need. */
        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                struct kqid qid;
-               got[cnt] = NULL;
                if (type != -1 && cnt != type)
                        continue;
                switch (cnt) {
diff --git a/fs/splice.c b/fs/splice.c
index bef92b4..2cf3994 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -189,6 +189,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
        unsigned int spd_pages = spd->nr_pages;
        int ret, do_wakeup, page_nr;
 
+       if (!spd_pages)
+               return 0;
+
        ret = 0;
        do_wakeup = 0;
        page_nr = 0;
diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
index 2d174b1..b33f39e 100644
--- a/fs/xfs/xfs_attr_list.c
+++ b/fs/xfs/xfs_attr_list.c
@@ -205,8 +205,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
                                        sbp->namelen,
                                        sbp->valuelen,
                                        &sbp->name[sbp->namelen]);
-               if (error)
+               if (error) {
+                       kmem_free(sbuf);
                        return error;
+               }
                if (context->seen_enough)
                        break;
                cursor->offset++;
@@ -452,14 +454,13 @@ xfs_attr3_leaf_list_int(
                                args.rmtblkcnt = xfs_attr3_rmt_blocks(
                                                        args.dp->i_mount, 
valuelen);
                                retval = xfs_attr_rmtval_get(&args);
-                               if (retval)
-                                       return retval;
-                               retval = context->put_listent(context,
-                                               entry->flags,
-                                               name_rmt->name,
-                                               (int)name_rmt->namelen,
-                                               valuelen,
-                                               args.value);
+                               if (!retval)
+                                       retval = context->put_listent(context,
+                                                       entry->flags,
+                                                       name_rmt->name,
+                                                       (int)name_rmt->namelen,
+                                                       valuelen,
+                                                       args.value);
                                kmem_free(args.value);
                        } else {
                                retval = context->put_listent(context,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a917265..c2bfb4d 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2073,7 +2073,7 @@ extern long do_sys_open(int dfd, const char __user 
*filename, int flags,
 extern struct file *file_open_name(struct filename *, int, umode_t);
 extern struct file *filp_open(const char *, int, umode_t);
 extern struct file *file_open_root(struct dentry *, struct vfsmount *,
-                                  const char *, int);
+                                  const char *, int, umode_t);
 extern struct file * dentry_open(const struct path *, int, const struct cred 
*);
 extern int filp_close(struct file *, fl_owner_t id);
 
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index ecb8754..e6e8cf9 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -554,7 +554,7 @@ do {                                                        
\
 
 #define do_trace_printk(fmt, args...)                                  \
 do {                                                                   \
-       static const char *trace_printk_fmt                             \
+       static const char *trace_printk_fmt __used                      \
                __attribute__((section("__trace_printk_fmt"))) =        \
                __builtin_constant_p(fmt) ? fmt : NULL;                 \
                                                                        \
@@ -598,7 +598,7 @@ int __trace_printk(unsigned long ip, const char *fmt, ...);
  */
 
 #define trace_puts(str) ({                                             \
-       static const char *trace_printk_fmt                             \
+       static const char *trace_printk_fmt __used                      \
                __attribute__((section("__trace_printk_fmt"))) =        \
                __builtin_constant_p(str) ? str : NULL;                 \
                                                                        \
@@ -620,7 +620,7 @@ extern void trace_dump_stack(int skip);
 #define ftrace_vprintk(fmt, vargs)                                     \
 do {                                                                   \
        if (__builtin_constant_p(fmt)) {                                \
-               static const char *trace_printk_fmt                     \
+               static const char *trace_printk_fmt __used              \
                  __attribute__((section("__trace_printk_fmt"))) =      \
                        __builtin_constant_p(fmt) ? fmt : NULL;         \
                                                                        \
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 554548c..42563ea 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -52,7 +52,7 @@ enum {
        /* one minute for the sake of bringup. Generally, commands must always
         * complete and we may need to increase this timeout value
         */
-       MLX5_CMD_TIMEOUT_MSEC   = 7200 * 1000,
+       MLX5_CMD_TIMEOUT_MSEC   = 60 * 1000,
        MLX5_CMD_WQ_MAX_NAME    = 32,
 };
 
diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
index 5f487d7..b501e9c 100644
--- a/include/linux/mtd/map.h
+++ b/include/linux/mtd/map.h
@@ -238,8 +238,11 @@ struct map_info {
           If there is no cache to care about this can be set to NULL. */
        void (*inval_cache)(struct map_info *, unsigned long, ssize_t);
 
-       /* set_vpp() must handle being reentered -- enable, enable, disable
-          must leave it enabled. */
+       /* This will be called with 1 as parameter when the first map user
+        * needs VPP, and called with 0 when the last user exits. The map
+        * core maintains a reference counter, and assumes that VPP is a
+        * global resource applying to all mapped flash chips on the system.
+        */
        void (*set_vpp)(struct map_info *, int);
 
        unsigned long pfow_base;
diff --git a/include/linux/pci.h b/include/linux/pci.h
index bbaceee..cc47b9c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -343,6 +343,7 @@ struct pci_dev {
        unsigned int    __aer_firmware_first:1;
        unsigned int    broken_intx_masking:1;
        unsigned int    io_window_1k:1; /* Intel P2P bridge 1K I/O windows */
+       unsigned int    non_compliant_bars:1;   /* broken BARs; ignore them */
        pci_dev_flags_t dev_flags;
        atomic_t        enable_cnt;     /* pci_enable_device has been called */
 
diff --git a/include/linux/tty.h b/include/linux/tty.h
index dda9ac5..7866e9c 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -564,7 +564,7 @@ static inline int tty_ldisc_receive_buf(struct tty_ldisc 
*ld, unsigned char *p,
                count = ld->ops->receive_buf2(ld->tty, p, f, count);
        else {
                count = min_t(int, count, ld->tty->receive_room);
-               if (count)
+               if (count && ld->ops->receive_buf)
                        ld->ops->receive_buf(ld->tty, p, f, count);
        }
        return count;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5a90a64..e4a1467 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6786,6 +6786,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
                }
        }
 
+       /* symmetric to unaccount_event() in _free_event() */
+       account_event(event);
+
        return event;
 
 err_pmu:
@@ -7091,8 +7094,6 @@ SYSCALL_DEFINE5(perf_event_open,
                }
        }
 
-       account_event(event);
-
        /*
         * Special case software events and allow them to be part of
         * any hardware group.
@@ -7299,8 +7300,6 @@ perf_event_create_kernel_counter(struct perf_event_attr 
*attr, int cpu,
                goto err;
        }
 
-       account_event(event);
-
        ctx = find_get_context(event->pmu, task, cpu);
        if (IS_ERR(ctx)) {
                err = PTR_ERR(ctx);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 42d354e..e74dddd 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4486,6 +4486,7 @@ migration_call(struct notifier_block *nfb, unsigned long 
action, void *hcpu)
 
        case CPU_UP_PREPARE:
                rq->calc_load_update = calc_load_update;
+               account_reset_rq(rq);
                break;
 
        case CPU_ONLINE:
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 88c85b2..3db2ef0 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1414,3 +1414,16 @@ static inline u64 irq_time_read(int cpu)
 }
 #endif /* CONFIG_64BIT */
 #endif /* CONFIG_IRQ_TIME_ACCOUNTING */
+
+static inline void account_reset_rq(struct rq *rq)
+{
+#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+       rq->prev_irq_time = 0;
+#endif
+#ifdef CONFIG_PARAVIRT
+       rq->prev_steal_time = 0;
+#endif
+#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
+       rq->prev_steal_time_rq = 0;
+#endif
+}
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index d457005..dd8f37c 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1319,7 +1319,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
        }
 
        mnt = task_active_pid_ns(current)->proc_mnt;
-       file = file_open_root(mnt->mnt_root, mnt, pathname, flags);
+       file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0);
        result = PTR_ERR(file);
        if (IS_ERR(file))
                goto out_putname;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index bc88bc2..4ac996f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4367,7 +4367,10 @@ static ssize_t tracing_splice_read_pipe(struct file 
*filp,
 
        spd.nr_pages = i;
 
-       ret = splice_to_pipe(pipe, &spd);
+       if (i)
+               ret = splice_to_pipe(pipe, &spd);
+       else
+               ret = 0;
 out:
        splice_shrink_spd(&spd);
        return ret;
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 2aefbee..56e083e 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -118,8 +118,12 @@ static int func_prolog_dec(struct trace_array *tr,
                return 0;
 
        local_save_flags(*flags);
-       /* slight chance to get a false positive on tracing_cpu */
-       if (!irqs_disabled_flags(*flags))
+       /*
+        * Slight chance to get a false positive on tracing_cpu,
+        * although I'm starting to think there isn't a chance.
+        * Leave this for now just to be paranoid.
+        */
+       if (!irqs_disabled_flags(*flags) && !preempt_count())
                return 0;
 
        *data = per_cpu_ptr(tr->trace_buffer.data, cpu);
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index 7c8cef6..7b90047 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -292,6 +292,9 @@ static int t_show(struct seq_file *m, void *v)
        const char *str = *fmt;
        int i;
 
+       if (!*fmt)
+               return 0;
+
        seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
 
        /*
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 3dc61c4..c4a71a1 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1943,10 +1943,14 @@ void udp_v4_early_demux(struct sk_buff *skb)
                if (!in_dev)
                        return;
 
-               ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
-                                      iph->protocol);
-               if (!ours)
-                       return;
+               /* we are supposed to accept bcast packets */
+               if (skb->pkt_type == PACKET_MULTICAST) {
+                       ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+                                              iph->protocol);
+                       if (!ours)
+                               return;
+               }
+
                sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
                                                   uh->source, iph->saddr, dif);
        } else if (skb->pkt_type == PACKET_HOST) {
diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c 
b/net/netfilter/ipvs/ip_vs_pe_sip.c
index bed5f70..bb318e4 100644
--- a/net/netfilter/ipvs/ip_vs_pe_sip.c
+++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_param *p, struct 
sk_buff *skb)
        dptr = skb->data + dataoff;
        datalen = skb->len - dataoff;
 
-       if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen))
+       if (get_callid(dptr, 0, datalen, &matchoff, &matchlen))
                return -EINVAL;
 
        /* N.B: pe_data is only set on success,
diff --git a/net/socket.c b/net/socket.c
index 404be5e..bfd2411 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2390,31 +2390,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, 
unsigned int vlen,
                        break;
        }
 
-out_put:
-       fput_light(sock->file, fput_needed);
-
        if (err == 0)
-               return datagrams;
+               goto out_put;
 
-       if (datagrams != 0) {
+       if (datagrams == 0) {
+               datagrams = err;
+               goto out_put;
+       }
+
+       /*
+        * We may return less entries than requested (vlen) if the
+        * sock is non block and there aren't enough datagrams...
+        */
+       if (err != -EAGAIN) {
                /*
-                * We may return less entries than requested (vlen) if the
-                * sock is non block and there aren't enough datagrams...
+                * ... or  if recvmsg returns an error after we
+                * received some datagrams, where we record the
+                * error to return on the next call or if the
+                * app asks about it using getsockopt(SO_ERROR).
                 */
-               if (err != -EAGAIN) {
-                       /*
-                        * ... or  if recvmsg returns an error after we
-                        * received some datagrams, where we record the
-                        * error to return on the next call or if the
-                        * app asks about it using getsockopt(SO_ERROR).
-                        */
-                       sock->sk->sk_err = -err;
-               }
-
-               return datagrams;
+               sock->sk->sk_err = -err;
        }
+out_put:
+       fput_light(sock->file, fput_needed);
 
-       return err;
+       return datagrams;
 }
 
 SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index f3e2b7d..b81e0a3 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1189,14 +1189,14 @@ int sunrpc_cache_pipe_upcall(struct cache_detail 
*detail, struct cache_head *h)
        }
 
        crq->q.reader = 0;
-       crq->item = cache_get(h);
        crq->buf = buf;
        crq->len = 0;
        crq->readers = 0;
        spin_lock(&queue_lock);
-       if (test_bit(CACHE_PENDING, &h->flags))
+       if (test_bit(CACHE_PENDING, &h->flags)) {
+               crq->item = cache_get(h);
                list_add_tail(&crq->q.list, &detail->queue);
-       else
+       } else
                /* Lost a race, no longer PENDING, so don't enqueue */
                ret = -EAGAIN;
        spin_unlock(&queue_lock);
diff --git a/scripts/coccinelle/iterators/use_after_iter.cocci 
b/scripts/coccinelle/iterators/use_after_iter.cocci
index f085f59..ce8cc9c 100644
--- a/scripts/coccinelle/iterators/use_after_iter.cocci
+++ b/scripts/coccinelle/iterators/use_after_iter.cocci
@@ -123,7 +123,7 @@ list_remove_head(x,c,...)
 |
 sizeof(<+...c...+>)
 |
-&c->member
+ &c->member
 |
 c = E
 |
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index 1395760..c92358d 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -131,11 +131,11 @@ echo 'rm -rf $RPM_BUILD_ROOT'
 echo ""
 echo "%post"
 echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r 
/boot/System.map-$KERNELRELEASE ]; then"
-echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm"
-echo "cp /boot/System.map-$KERNELRELEASE /boot/System.map-$KERNELRELEASE-rpm"
+echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm"
+echo "cp /boot/System.map-$KERNELRELEASE /boot/.System.map-$KERNELRELEASE-rpm"
 echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE"
-echo "/sbin/installkernel $KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm 
/boot/System.map-$KERNELRELEASE-rpm"
-echo "rm -f /boot/vmlinuz-$KERNELRELEASE-rpm 
/boot/System.map-$KERNELRELEASE-rpm"
+echo "/sbin/installkernel $KERNELRELEASE /boot/.vmlinuz-$KERNELRELEASE-rpm 
/boot/.System.map-$KERNELRELEASE-rpm"
+echo "rm -f /boot/.vmlinuz-$KERNELRELEASE-rpm 
/boot/.System.map-$KERNELRELEASE-rpm"
 echo "fi"
 echo ""
 echo "%files"
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index eef182b..6d8151d 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -177,8 +177,12 @@ static void cs_automute(struct hda_codec *codec)
        snd_hda_gen_update_outputs(codec);
 
        if (spec->gpio_eapd_hp || spec->gpio_eapd_speaker) {
-               spec->gpio_data = spec->gen.hp_jack_present ?
-                       spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
+               if (spec->gen.automute_speaker)
+                       spec->gpio_data = spec->gen.hp_jack_present ?
+                               spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
+               else
+                       spec->gpio_data =
+                               spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
                snd_hda_codec_write(codec, 0x01, 0,
                                    AC_VERB_SET_GPIO_DATA, spec->gpio_data);
        }
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 08d8733..3399156 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -2884,6 +2884,7 @@ static void intel8x0_measure_ac97_clock(struct intel8x0 
*chip)
 
 static struct snd_pci_quirk intel8x0_clock_list[] = {
        SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
+       SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
        SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
        SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
        SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),
diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c
index fefc561..51f8e63 100644
--- a/sound/soc/samsung/s3c-i2s-v2.c
+++ b/sound/soc/samsung/s3c-i2s-v2.c
@@ -726,7 +726,7 @@ static int s3c2412_i2s_resume(struct snd_soc_dai *dai)
 #endif
 
 int s3c_i2sv2_register_component(struct device *dev, int id,
-                          struct snd_soc_component_driver *cmp_drv,
+                          const struct snd_soc_component_driver *cmp_drv,
                           struct snd_soc_dai_driver *dai_drv)
 {
        struct snd_soc_dai_ops *ops = drv->ops;
diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h
index 90abab3..d068414 100644
--- a/sound/soc/samsung/s3c-i2s-v2.h
+++ b/sound/soc/samsung/s3c-i2s-v2.h
@@ -101,7 +101,7 @@ extern int s3c_i2sv2_probe(struct snd_soc_dai *dai,
  * soc core.
  */
 extern int s3c_i2sv2_register_component(struct device *dev, int id,
-                                       struct snd_soc_component_driver 
*cmp_drv,
+                                       const struct snd_soc_component_driver 
*cmp_drv,
                                        struct snd_soc_dai_driver *dai_drv);
 
 #endif /* __SND_SOC_S3C24XX_S3C_I2SV2_I2S_H */
diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index 86f80c6..1329d77 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -283,6 +283,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, 
int iface,
        unsigned char data[3];
        int err, crate;
 
+       if (get_iface_desc(alts)->bNumEndpoints < 1)
+               return -EINVAL;
        ep = get_endpoint(alts, 0)->bEndpointAddress;
 
        /* if endpoint doesn't have sampling rate control, bail out */
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 105ece3..c686ec8 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -409,6 +409,9 @@ exit_clear:
  *
  * New endpoints will be added to chip->ep_list and must be freed by
  * calling snd_usb_endpoint_free().
+ *
+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that
+ * bNumEndpoints > 1 beforehand.
  */
 struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
                                              struct usb_host_interface *alts,
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index f8b15a9..792c903 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1456,7 +1456,11 @@ static int snd_microii_spdif_default_get(struct 
snd_kcontrol *kcontrol,
 
        /* use known values for that card: interface#1 altsetting#1 */
        iface = usb_ifnum_to_if(mixer->chip->dev, 1);
+       if (!iface || iface->num_altsetting < 2)
+               return -EINVAL;
        alts = &iface->altsetting[1];
+       if (get_iface_desc(alts)->bNumEndpoints < 1)
+               return -EINVAL;
        ep = get_endpoint(alts, 0)->bEndpointAddress;
 
        err = snd_usb_ctl_msg(mixer->chip->dev,
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index ede4b92..d2fba88 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int 
iface,
        unsigned char data[1];
        int err;
 
+       if (get_iface_desc(alts)->bNumEndpoints < 1)
+               return -EINVAL;
        ep = get_endpoint(alts, 0)->bEndpointAddress;
 
        data[0] = 1;
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 44a04f3..e89156d 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -168,6 +168,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio 
*chip,
        }
        alts = &iface->altsetting[fp->altset_idx];
        altsd = get_iface_desc(alts);
+       if (altsd->bNumEndpoints < 1) {
+               kfree(fp);
+               kfree(rate_table);
+               return -EINVAL;
+       }
+
        fp->protocol = altsd->bInterfaceProtocol;
 
        if (fp->datainterval == 0)
diff --git a/tools/perf/Documentation/perf-stat.txt 
b/tools/perf/Documentation/perf-stat.txt
index 80c7da6..693b62a 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -50,6 +50,14 @@ OPTIONS
 --scale::
        scale/normalize counter values
 
+-d::
+--detailed::
+       print more detailed statistics, can be specified up to 3 times
+
+          -d:          detailed events, L1 and LLC data cache
+        -d -d:     more detailed events, dTLB and iTLB events
+     -d -d -d:     very detailed events, adding prefetch events
+
 -r::
 --repeat=<n>::
        repeat command and print average + stddev (max: 100). 0 means forever.
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index c232d8d..2febc09 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -129,13 +129,12 @@ static int pmu_aliases_parse(char *dir, struct list_head 
*head)
 {
        struct dirent *evt_ent;
        DIR *event_dir;
-       int ret = 0;
 
        event_dir = opendir(dir);
        if (!event_dir)
                return -EINVAL;
 
-       while (!ret && (evt_ent = readdir(event_dir))) {
+       while ((evt_ent = readdir(event_dir))) {
                char path[PATH_MAX];
                char *name = evt_ent->d_name;
                FILE *file;
@@ -145,16 +144,19 @@ static int pmu_aliases_parse(char *dir, struct list_head 
*head)
 
                snprintf(path, PATH_MAX, "%s/%s", dir, name);
 
-               ret = -EINVAL;
                file = fopen(path, "r");
-               if (!file)
-                       break;
-               ret = perf_pmu__new_alias(head, name, file);
+               if (!file) {
+                       pr_debug("Cannot open %s\n", path);
+                       continue;
+               }
+
+               if (perf_pmu__new_alias(head, name, file) < 0)
+                       pr_debug("Cannot set up %s\n", name);
                fclose(file);
        }
 
        closedir(event_dir);
-       return ret;
+       return 0;
 }
 
 /*
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 634048e..afcaf33 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -450,6 +450,16 @@ static struct kvm *kvm_create_vm(unsigned long type)
        if (!kvm)
                return ERR_PTR(-ENOMEM);
 
+       spin_lock_init(&kvm->mmu_lock);
+       atomic_inc(&current->mm->mm_count);
+       kvm->mm = current->mm;
+       kvm_eventfd_init(kvm);
+       mutex_init(&kvm->lock);
+       mutex_init(&kvm->irq_lock);
+       mutex_init(&kvm->slots_lock);
+       atomic_set(&kvm->users_count, 1);
+       INIT_LIST_HEAD(&kvm->devices);
+
        r = kvm_arch_init_vm(kvm, type);
        if (r)
                goto out_err_nodisable;
@@ -486,16 +496,6 @@ static struct kvm *kvm_create_vm(unsigned long type)
                        goto out_err;
        }
 
-       spin_lock_init(&kvm->mmu_lock);
-       kvm->mm = current->mm;
-       atomic_inc(&kvm->mm->mm_count);
-       kvm_eventfd_init(kvm);
-       mutex_init(&kvm->lock);
-       mutex_init(&kvm->irq_lock);
-       mutex_init(&kvm->slots_lock);
-       atomic_set(&kvm->users_count, 1);
-       INIT_LIST_HEAD(&kvm->devices);
-
        r = kvm_init_mmu_notifier(kvm);
        if (r)
                goto out_err;
@@ -515,6 +515,7 @@ out_err_nodisable:
                kfree(kvm->buses[i]);
        kfree(kvm->memslots);
        kvm_arch_free_vm(kvm);
+       mmdrop(current->mm);
        return ERR_PTR(r);
 }
 

Reply via email to