3.10.11: add missing patch from genpatches20130908

2 files changed, 1134 insertions, 0 deletions

diff --git a/3.10.11/0000_README b/3.10.11/0000_README
index b92d850..a305fe5 100644
--- a/3.10.11/0000_README
+++ b/3.10.11/0000_README
@@ -2,6 +2,10 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
+Patch:	1010_linux-3.10.11.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.10.11
+
 Patch:	4420_grsecurity-2.9.1-3.10.11-201309081953.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
diff --git a/3.10.11/1010_linux-3.10.11.patch b/3.10.11/1010_linux-3.10.11.patch
new file mode 100644
index 0000000..ff57b3e
--- /dev/null
+++ b/3.10.11/1010_linux-3.10.11.patch
@@ -0,0 +1,1130 @@
+diff --git a/Documentation/hwmon/k10temp b/Documentation/hwmon/k10temp
+index 90956b6..4dfdc8f 100644
+--- a/Documentation/hwmon/k10temp
++++ b/Documentation/hwmon/k10temp
+@@ -12,6 +12,7 @@ Supported chips:
+ * AMD Family 12h processors: "Llano" (E2/A4/A6/A8-Series)
+ * AMD Family 14h processors: "Brazos" (C/E/G/Z-Series)
+ * AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity"
++* AMD Family 16h processors: "Kabini"
+ 
+   Prefix: 'k10temp'
+   Addresses scanned: PCI space
+diff --git a/Makefile b/Makefile
+index b119684..595076d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 10
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = TOSSUG Baby Fish
+ 
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 13609e0..05db95d 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -170,6 +170,7 @@ static void __init xen_percpu_init(void *unused)
+ 	per_cpu(xen_vcpu, cpu) = vcpup;
+ 
+ 	enable_percpu_irq(xen_events_irq, 0);
++	put_cpu();
+ }
+ 
+ static void xen_restart(char str, const char *cmd)
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 74991fe..fe404e7 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -986,6 +986,7 @@ config RELOCATABLE
+ 	  must live at a different physical address than the primary
+ 	  kernel.
+ 
++# This value must have zeroes in the bottom 60 bits otherwise lots will break
+ config PAGE_OFFSET
+ 	hex
+ 	default "0xc000000000000000"
+diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
+index 988c812..b9f4262 100644
+--- a/arch/powerpc/include/asm/page.h
++++ b/arch/powerpc/include/asm/page.h
+@@ -211,9 +211,19 @@ extern long long virt_phys_offset;
+ #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + VIRT_PHYS_OFFSET))
+ #define __pa(x) ((unsigned long)(x) - VIRT_PHYS_OFFSET)
+ #else
++#ifdef CONFIG_PPC64
++/*
++ * gcc miscompiles (unsigned long)(&static_var) - PAGE_OFFSET
++ * with -mcmodel=medium, so we use & and | instead of - and + on 64-bit.
++ */
++#define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) | PAGE_OFFSET))
++#define __pa(x) ((unsigned long)(x) & 0x0fffffffffffffffUL)
++
++#else /* 32-bit, non book E */
+ #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + PAGE_OFFSET - MEMORY_START))
+ #define __pa(x) ((unsigned long)(x) - PAGE_OFFSET + MEMORY_START)
+ #endif
++#endif
+ 
+ /*
+  * Unfortunately the PLT is in the BSS in the PPC32 ELF ABI,
+diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
+index d92f387..e2a0a16 100644
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,7 +35,13 @@
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
+ #include <asm/mmu.h>
++#include <asm/machdep.h>
+ 
++
++/*
++ * This isn't a module but we expose that to userspace
++ * via /proc so leave the definitions here
++ */
+ #define MODULE_VERS "1.9"
+ #define MODULE_NAME "lparcfg"
+ 
+@@ -418,7 +424,8 @@ static void parse_em_data(struct seq_file *m)
+ {
+ 	unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+ 
+-	if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
++	if (firmware_has_feature(FW_FEATURE_LPAR) &&
++	    plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+ 		seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
+ }
+ 
+@@ -677,7 +684,6 @@ static int lparcfg_open(struct inode *inode, struct file *file)
+ }
+ 
+ static const struct file_operations lparcfg_fops = {
+-	.owner		= THIS_MODULE,
+ 	.read		= seq_read,
+ 	.write		= lparcfg_write,
+ 	.open		= lparcfg_open,
+@@ -699,14 +705,4 @@ static int __init lparcfg_init(void)
+ 	}
+ 	return 0;
+ }
+-
+-static void __exit lparcfg_cleanup(void)
+-{
+-	remove_proc_subtree("powerpc/lparcfg", NULL);
+-}
+-
+-module_init(lparcfg_init);
+-module_exit(lparcfg_cleanup);
+-MODULE_DESCRIPTION("Interface for LPAR configuration data");
+-MODULE_AUTHOR("Dave Engebretsen");
+-MODULE_LICENSE("GPL");
++machine_device_initcall(pseries, lparcfg_init);
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 1f34e92..7a5bf1b 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -78,8 +78,8 @@ __ref void *alloc_low_pages(unsigned int num)
+ 	return __va(pfn << PAGE_SHIFT);
+ }
+ 
+-/* need 4 4k for initial PMD_SIZE, 4k for 0-ISA_END_ADDRESS */
+-#define INIT_PGT_BUF_SIZE	(5 * PAGE_SIZE)
++/* need 3 4k for initial PMD_SIZE,  3 4k for 0-ISA_END_ADDRESS */
++#define INIT_PGT_BUF_SIZE	(6 * PAGE_SIZE)
+ RESERVE_BRK(early_pgt_alloc, INIT_PGT_BUF_SIZE);
+ void  __init early_alloc_pgt_buf(void)
+ {
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 80403c1..45af90a 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -987,6 +987,10 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	ec_skip_dsdt_scan, "HP Folio 13", {
+ 	DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ 	DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13"),}, NULL},
++	{
++	ec_validate_ecdt, "ASUS hardware", {
++	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
++	DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
+ 	{},
+ };
+ 
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 14f8a69..86abbff 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -152,6 +152,8 @@ static ssize_t show_mem_removable(struct device *dev,
+ 		container_of(dev, struct memory_block, dev);
+ 
+ 	for (i = 0; i < sections_per_block; i++) {
++		if (!present_section_nr(mem->start_section_nr + i))
++			continue;
+ 		pfn = section_nr_to_pfn(mem->start_section_nr + i);
+ 		ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
+ 	}
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index 02f490b..bb8c3bb 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -362,7 +362,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
+ 		rbnode = kzalloc(sizeof *rbnode, GFP_KERNEL);
+ 		if (!rbnode)
+ 			return -ENOMEM;
+-		rbnode->blklen = sizeof(*rbnode);
++		rbnode->blklen = 1;
+ 		rbnode->base_reg = reg;
+ 		rbnode->block = kmalloc(rbnode->blklen * map->cache_word_size,
+ 					GFP_KERNEL);
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 01f6c2c..a365780 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -4246,7 +4246,7 @@
+ #define EDP_LINK_TRAIN_600MV_0DB_IVB		(0x30 <<22)
+ #define EDP_LINK_TRAIN_600MV_3_5DB_IVB		(0x36 <<22)
+ #define EDP_LINK_TRAIN_800MV_0DB_IVB		(0x38 <<22)
+-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB		(0x33 <<22)
++#define EDP_LINK_TRAIN_800MV_3_5DB_IVB		(0x3e <<22)
+ 
+ /* legacy values */
+ #define EDP_LINK_TRAIN_500MV_0DB_IVB		(0x00 <<22)
+diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+index d550226..9d2cd20 100644
+--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
++++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+@@ -20,8 +20,8 @@ nouveau_mc(void *obj)
+ 	return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_MC];
+ }
+ 
+-#define nouveau_mc_create(p,e,o,d)                                             \
+-	nouveau_mc_create_((p), (e), (o), sizeof(**d), (void **)d)
++#define nouveau_mc_create(p,e,o,m,d)                                           \
++	nouveau_mc_create_((p), (e), (o), (m), sizeof(**d), (void **)d)
+ #define nouveau_mc_destroy(p) ({                                               \
+ 	struct nouveau_mc *pmc = (p); _nouveau_mc_dtor(nv_object(pmc));        \
+ })
+@@ -33,7 +33,8 @@ nouveau_mc(void *obj)
+ })
+ 
+ int  nouveau_mc_create_(struct nouveau_object *, struct nouveau_object *,
+-			struct nouveau_oclass *, int, void **);
++			struct nouveau_oclass *, const struct nouveau_mc_intr *,
++			int, void **);
+ void _nouveau_mc_dtor(struct nouveau_object *);
+ int  _nouveau_mc_init(struct nouveau_object *);
+ int  _nouveau_mc_fini(struct nouveau_object *, bool);
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+index 1c0330b..ec9cd6f 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+@@ -80,7 +80,9 @@ _nouveau_mc_dtor(struct nouveau_object *object)
+ 
+ int
+ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
+-		   struct nouveau_oclass *oclass, int length, void **pobject)
++		   struct nouveau_oclass *oclass,
++		   const struct nouveau_mc_intr *intr_map,
++		   int length, void **pobject)
+ {
+ 	struct nouveau_device *device = nv_device(parent);
+ 	struct nouveau_mc *pmc;
+@@ -92,6 +94,8 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
+ 	if (ret)
+ 		return ret;
+ 
++	pmc->intr_map = intr_map;
++
+ 	ret = request_irq(device->pdev->irq, nouveau_mc_intr,
+ 			  IRQF_SHARED, "nouveau", pmc);
+ 	if (ret < 0)
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+index 8c76971..64aa4ed 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.c
+@@ -50,12 +50,11 @@ nv04_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ 	struct nv04_mc_priv *priv;
+ 	int ret;
+ 
+-	ret = nouveau_mc_create(parent, engine, oclass, &priv);
++	ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
+ 	*pobject = nv_object(priv);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->base.intr_map = nv04_mc_intr;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+index 5191937..d989178 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+@@ -36,12 +36,11 @@ nv44_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ 	struct nv44_mc_priv *priv;
+ 	int ret;
+ 
+-	ret = nouveau_mc_create(parent, engine, oclass, &priv);
++	ret = nouveau_mc_create(parent, engine, oclass, nv04_mc_intr, &priv);
+ 	*pobject = nv_object(priv);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->base.intr_map = nv04_mc_intr;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+index d796924..732d810 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+@@ -52,12 +52,11 @@ nv50_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ 	struct nv50_mc_priv *priv;
+ 	int ret;
+ 
+-	ret = nouveau_mc_create(parent, engine, oclass, &priv);
++	ret = nouveau_mc_create(parent, engine, oclass, nv50_mc_intr, &priv);
+ 	*pobject = nv_object(priv);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->base.intr_map = nv50_mc_intr;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+index e82fd21..0d57b4d 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv98.c
+@@ -54,12 +54,11 @@ nv98_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ 	struct nv98_mc_priv *priv;
+ 	int ret;
+ 
+-	ret = nouveau_mc_create(parent, engine, oclass, &priv);
++	ret = nouveau_mc_create(parent, engine, oclass, nv98_mc_intr, &priv);
+ 	*pobject = nv_object(priv);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->base.intr_map = nv98_mc_intr;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+index 737bd4b..4c97cd2 100644
+--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nvc0.c
+@@ -56,12 +56,11 @@ nvc0_mc_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
+ 	struct nvc0_mc_priv *priv;
+ 	int ret;
+ 
+-	ret = nouveau_mc_create(parent, engine, oclass, &priv);
++	ret = nouveau_mc_create(parent, engine, oclass, nvc0_mc_intr, &priv);
+ 	*pobject = nv_object(priv);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->base.intr_map = nvc0_mc_intr;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+index 3751730..1a0bf07 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+@@ -29,7 +29,9 @@
+ #include <drm/drmP.h>
+ #include <drm/ttm/ttm_bo_driver.h>
+ 
+-#define VMW_PPN_SIZE sizeof(unsigned long)
++#define VMW_PPN_SIZE (sizeof(unsigned long))
++/* A future safe maximum remap size. */
++#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE)
+ 
+ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
+ 			 struct page *pages[],
+@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
+ {
+ 	SVGAFifoCmdDefineGMR2 define_cmd;
+ 	SVGAFifoCmdRemapGMR2 remap_cmd;
+-	uint32_t define_size = sizeof(define_cmd) + 4;
+-	uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4;
+ 	uint32_t *cmd;
+ 	uint32_t *cmd_orig;
++	uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd);
++	uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0);
++	uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num;
++	uint32_t remap_pos = 0;
++	uint32_t cmd_size = define_size + remap_size;
+ 	uint32_t i;
+ 
+-	cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size);
++	cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size);
+ 	if (unlikely(cmd == NULL))
+ 		return -ENOMEM;
+ 
+ 	define_cmd.gmrId = gmr_id;
+ 	define_cmd.numPages = num_pages;
+ 
++	*cmd++ = SVGA_CMD_DEFINE_GMR2;
++	memcpy(cmd, &define_cmd, sizeof(define_cmd));
++	cmd += sizeof(define_cmd) / sizeof(*cmd);
++
++	/*
++	 * Need to split the command if there are too many
++	 * pages that goes into the gmr.
++	 */
++
+ 	remap_cmd.gmrId = gmr_id;
+ 	remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ?
+ 		SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32;
+-	remap_cmd.offsetPages = 0;
+-	remap_cmd.numPages = num_pages;
+ 
+-	*cmd++ = SVGA_CMD_DEFINE_GMR2;
+-	memcpy(cmd, &define_cmd, sizeof(define_cmd));
+-	cmd += sizeof(define_cmd) / sizeof(uint32);
++	while (num_pages > 0) {
++		unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP);
++
++		remap_cmd.offsetPages = remap_pos;
++		remap_cmd.numPages = nr;
+ 
+-	*cmd++ = SVGA_CMD_REMAP_GMR2;
+-	memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
+-	cmd += sizeof(remap_cmd) / sizeof(uint32);
++		*cmd++ = SVGA_CMD_REMAP_GMR2;
++		memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
++		cmd += sizeof(remap_cmd) / sizeof(*cmd);
+ 
+-	for (i = 0; i < num_pages; ++i) {
+-		if (VMW_PPN_SIZE <= 4)
+-			*cmd = page_to_pfn(*pages++);
+-		else
+-			*((uint64_t *)cmd) = page_to_pfn(*pages++);
++		for (i = 0; i < nr; ++i) {
++			if (VMW_PPN_SIZE <= 4)
++				*cmd = page_to_pfn(*pages++);
++			else
++				*((uint64_t *)cmd) = page_to_pfn(*pages++);
+ 
+-		cmd += VMW_PPN_SIZE / sizeof(*cmd);
++			cmd += VMW_PPN_SIZE / sizeof(*cmd);
++		}
++
++		num_pages -= nr;
++		remap_pos += nr;
+ 	}
+ 
+-	vmw_fifo_commit(dev_priv, define_size + remap_size);
++	BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd));
++
++	vmw_fifo_commit(dev_priv, cmd_size);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 0428e8a..df064e8 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -296,8 +296,8 @@ config SENSORS_K10TEMP
+ 	  If you say yes here you get support for the temperature
+ 	  sensor(s) inside your CPU. Supported are later revisions of
+ 	  the AMD Family 10h and all revisions of the AMD Family 11h,
+-	  12h (Llano), 14h (Brazos) and 15h (Bulldozer/Trinity)
+-	  microarchitectures.
++	  12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity) and
++	  16h (Kabini) microarchitectures.
+ 
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called k10temp.
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index e3b037c..e633856 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -1,5 +1,5 @@
+ /*
+- * k10temp.c - AMD Family 10h/11h/12h/14h/15h processor hardware monitoring
++ * k10temp.c - AMD Family 10h/11h/12h/14h/15h/16h processor hardware monitoring
+  *
+  * Copyright (c) 2009 Clemens Ladisch <clemens@ladisch.de>
+  *
+@@ -211,6 +211,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
+index 621c7a3..b83e3ca 100644
+--- a/drivers/misc/hpilo.c
++++ b/drivers/misc/hpilo.c
+@@ -759,7 +759,7 @@ static int ilo_probe(struct pci_dev *pdev,
+ 
+ 	/* Ignore subsystem_device = 0x1979 (set by BIOS)  */
+ 	if (pdev->subsystem_device == 0x1979)
+-		goto out;
++		return 0;
+ 
+ 	if (max_ccb > MAX_CCB)
+ 		max_ccb = MAX_CCB;
+@@ -899,7 +899,7 @@ static void __exit ilo_exit(void)
+ 	class_destroy(ilo_class);
+ }
+ 
+-MODULE_VERSION("1.4");
++MODULE_VERSION("1.4.1");
+ MODULE_ALIAS(ILO_NAME);
+ MODULE_DESCRIPTION(ILO_NAME);
+ MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 700fe55..1bf3f8b 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -176,16 +176,14 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
+ 	struct mei_me_hw *hw = to_me_hw(dev);
+ 	u32 hcsr = mei_hcsr_read(hw);
+ 
+-	dev_dbg(&dev->pdev->dev, "before reset HCSR = 0x%08x.\n", hcsr);
+-
+-	hcsr |= (H_RST | H_IG);
++	hcsr |= H_RST | H_IG | H_IS;
+ 
+ 	if (intr_enable)
+ 		hcsr |= H_IE;
+ 	else
+-		hcsr |= ~H_IE;
++		hcsr &= ~H_IE;
+ 
+-	mei_hcsr_set(hw, hcsr);
++	mei_me_reg_write(hw, H_CSR, hcsr);
+ 
+ 	if (dev->dev_state == MEI_DEV_POWER_DOWN)
+ 		mei_me_hw_reset_release(dev);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index 6bd0e92..417a089 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
+ 	struct ieee80211_conf *cur_conf = &priv->hw->conf;
+ 	bool txok;
+ 	int slot;
++	int hdrlen, padsize;
+ 
+ 	slot = strip_drv_header(priv, skb);
+ 	if (slot < 0) {
+@@ -504,6 +505,15 @@ send_mac80211:
+ 
+ 	ath9k_htc_tx_clear_slot(priv, slot);
+ 
++	/* Remove padding before handing frame back to mac80211 */
++	hdrlen = ieee80211_get_hdrlen_from_skb(skb);
++
++	padsize = hdrlen & 3;
++	if (padsize && skb->len > hdrlen + padsize) {
++		memmove(skb->data + padsize, skb->data, hdrlen);
++		skb_pull(skb, padsize);
++	}
++
+ 	/* Send status to mac80211 */
+ 	ieee80211_tx_status(priv->hw, skb);
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index 2ba4945..bd126c2 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -767,7 +767,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ 		IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		IEEE80211_HW_SPECTRUM_MGMT |
+ 		IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+-		IEEE80211_HW_SUPPORTS_RC_TABLE;
++		IEEE80211_HW_SUPPORTS_RC_TABLE |
++		IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+ 
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+ 		 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 35ced10..e33a659 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -173,8 +173,7 @@ static void ath_restart_work(struct ath_softc *sc)
+ {
+ 	ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+ 
+-	if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
+-	    AR_SREV_9550(sc->sc_ah))
++	if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
+ 		ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
+ 				     msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
+ 
+diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
+index e9010a4..0686375 100644
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1857,7 +1857,8 @@ void *carl9170_alloc(size_t priv_size)
+ 		     IEEE80211_HW_SUPPORTS_PS |
+ 		     IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		     IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
+-		     IEEE80211_HW_SIGNAL_DBM;
++		     IEEE80211_HW_SIGNAL_DBM |
++		     IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+ 
+ 	if (!modparam_noht) {
+ 		/*
+diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
+index 900f5f8..a8eff95 100644
+--- a/drivers/net/wireless/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/iwlegacy/4965-mac.c
+@@ -4446,9 +4446,9 @@ il4965_irq_tasklet(struct il_priv *il)
+ 			set_bit(S_RFKILL, &il->status);
+ 		} else {
+ 			clear_bit(S_RFKILL, &il->status);
+-			wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
+ 			il_force_reset(il, true);
+ 		}
++		wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
+ 
+ 		handled |= CSR_INT_BIT_RF_KILL;
+ 	}
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 705aa33..7e66a90 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -5912,7 +5912,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 	    IEEE80211_HW_SUPPORTS_PS |
+ 	    IEEE80211_HW_PS_NULLFUNC_STACK |
+ 	    IEEE80211_HW_AMPDU_AGGREGATION |
+-	    IEEE80211_HW_REPORTS_TX_ACK_STATUS;
++	    IEEE80211_HW_REPORTS_TX_ACK_STATUS |
++	    IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+ 
+ 	/*
+ 	 * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 69dd49c..ce3f129d 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -221,7 +221,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ 	pm8001_ha->main_cfg_tbl.pm8001_tbl.fatal_err_interrupt		= 0x01;
+ 	for (i = 0; i < PM8001_MAX_INB_NUM; i++) {
+ 		pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt	=
+-			PM8001_MPI_QUEUE | (64 << 16) | (0x00<<30);
++			PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x00<<30);
+ 		pm8001_ha->inbnd_q_tbl[i].upper_base_addr	=
+ 			pm8001_ha->memoryMap.region[IB + i].phys_addr_hi;
+ 		pm8001_ha->inbnd_q_tbl[i].lower_base_addr	=
+@@ -247,7 +247,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ 	}
+ 	for (i = 0; i < PM8001_MAX_OUTB_NUM; i++) {
+ 		pm8001_ha->outbnd_q_tbl[i].element_size_cnt	=
+-			PM8001_MPI_QUEUE | (64 << 16) | (0x01<<30);
++			PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x01<<30);
+ 		pm8001_ha->outbnd_q_tbl[i].upper_base_addr	=
+ 			pm8001_ha->memoryMap.region[OB + i].phys_addr_hi;
+ 		pm8001_ha->outbnd_q_tbl[i].lower_base_addr	=
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 302514d..e1c4896 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -275,7 +275,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ 
+ 	for (i = 0; i < PM8001_MAX_SPCV_INB_NUM; i++) {
+ 		pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt	=
+-			PM8001_MPI_QUEUE | (64 << 16) | (0x00<<30);
++			PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x00<<30);
+ 		pm8001_ha->inbnd_q_tbl[i].upper_base_addr	=
+ 			pm8001_ha->memoryMap.region[IB + i].phys_addr_hi;
+ 		pm8001_ha->inbnd_q_tbl[i].lower_base_addr	=
+@@ -301,7 +301,7 @@ static void init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+ 	}
+ 	for (i = 0; i < PM8001_MAX_SPCV_OUTB_NUM; i++) {
+ 		pm8001_ha->outbnd_q_tbl[i].element_size_cnt	=
+-			PM8001_MPI_QUEUE | (64 << 16) | (0x01<<30);
++			PM8001_MPI_QUEUE | (pm8001_ha->iomb_size << 16) | (0x01<<30);
+ 		pm8001_ha->outbnd_q_tbl[i].upper_base_addr	=
+ 			pm8001_ha->memoryMap.region[OB + i].phys_addr_hi;
+ 		pm8001_ha->outbnd_q_tbl[i].lower_base_addr	=
+diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
+index 6455305..a532ca5 100644
+--- a/drivers/staging/imx-drm/imx-drm-core.c
++++ b/drivers/staging/imx-drm/imx-drm-core.c
+@@ -681,6 +681,7 @@ found:
+ 
+ 	return i;
+ }
++EXPORT_SYMBOL_GPL(imx_drm_encoder_get_mux_id);
+ 
+ /*
+  * imx_drm_remove_encoder - remove an encoder
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 012ff8b..4c1b8db 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1086,7 +1086,6 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 		if (cmd->reject_reason)
+ 			return 0;
+ 
+-		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+ 		return 1;
+ 	}
+ 	/*
+@@ -1124,14 +1123,10 @@ after_immediate_data:
+ 		 */
+ 		cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd,
+ 					(unsigned char *)hdr, hdr->cmdsn);
+-		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
++		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
+ 			return -1;
+-		} else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+-			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
+-			return 0;
+-		}
+ 
+-		if (cmd->sense_reason) {
++		if (cmd->sense_reason || cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
+ 			int rc;
+ 
+ 			rc = iscsit_dump_data_payload(cmd->conn,
+@@ -1541,6 +1536,10 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
+ 		pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
+ 			" not set, protocol error.\n");
++		if (!cmd)
++			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++						 (unsigned char *)hdr);
++
+ 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
+ 					 (unsigned char *)hdr);
+ 	}
+@@ -1550,6 +1549,10 @@ int iscsit_handle_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 			" greater than MaxXmitDataSegmentLength: %u, protocol"
+ 			" error.\n", payload_length,
+ 			conn->conn_ops->MaxXmitDataSegmentLength);
++		if (!cmd)
++			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
++						 (unsigned char *)hdr);
++
+ 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
+ 					 (unsigned char *)hdr);
+ 	}
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 3402241..bc788c5 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1163,12 +1163,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ 		if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+ 			spin_unlock_bh(&np->np_thread_lock);
+ 			complete(&np->np_restart_comp);
+-			if (ret == -ENODEV) {
+-				iscsit_put_transport(conn->conn_transport);
+-				kfree(conn);
+-				conn = NULL;
++			iscsit_put_transport(conn->conn_transport);
++			kfree(conn);
++			conn = NULL;
++			if (ret == -ENODEV)
+ 				goto out;
+-			}
+ 			/* Get another socket */
+ 			return 1;
+ 		}
+diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
+index 4cb667d..9fabbf7 100644
+--- a/drivers/target/target_core_spc.c
++++ b/drivers/target/target_core_spc.c
+@@ -97,9 +97,12 @@ spc_emulate_inquiry_std(struct se_cmd *cmd, unsigned char *buf)
+ 
+ 	buf[7] = 0x2; /* CmdQue=1 */
+ 
+-	snprintf(&buf[8], 8, "LIO-ORG");
+-	snprintf(&buf[16], 16, "%s", dev->t10_wwn.model);
+-	snprintf(&buf[32], 4, "%s", dev->t10_wwn.revision);
++	memcpy(&buf[8], "LIO-ORG ", 8);
++	memset(&buf[16], 0x20, 16);
++	memcpy(&buf[16], dev->t10_wwn.model,
++	       min_t(size_t, strlen(dev->t10_wwn.model), 16));
++	memcpy(&buf[32], dev->t10_wwn.revision,
++	       min_t(size_t, strlen(dev->t10_wwn.revision), 4));
+ 	buf[4] = 31; /* Set additional length to 31 */
+ 
+ 	return 0;
+diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
+index 3396eb9..ac27671 100644
+--- a/drivers/tty/hvc/hvsi_lib.c
++++ b/drivers/tty/hvc/hvsi_lib.c
+@@ -341,8 +341,8 @@ void hvsilib_establish(struct hvsi_priv *pv)
+ 
+ 	pr_devel("HVSI@%x:   ... waiting handshake\n", pv->termno);
+ 
+-	/* Try for up to 200s */
+-	for (timeout = 0; timeout < 20; timeout++) {
++	/* Try for up to 400ms */
++	for (timeout = 0; timeout < 40; timeout++) {
+ 		if (pv->established)
+ 			goto established;
+ 		if (!hvsi_get_packet(pv))
+diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
+index 4b7e33e..ab1065a 100644
+--- a/drivers/usb/gadget/f_acm.c
++++ b/drivers/usb/gadget/f_acm.c
+@@ -285,6 +285,7 @@ static struct usb_string acm_string_defs[] = {
+ 	[ACM_CTRL_IDX].s = "CDC Abstract Control Model (ACM)",
+ 	[ACM_DATA_IDX].s = "CDC ACM Data",
+ 	[ACM_IAD_IDX ].s = "CDC Serial",
++	{  } /* end of list */
+ };
+ 
+ static struct usb_gadget_strings acm_string_table = {
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 0ddbece..c450fdb 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -3047,6 +3047,14 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 
+ 		dir_index = (u32) filp->f_pos;
+ 
++		/*
++		 * NFSv4 reserves cookies 1 and 2 for . and .. so we add
++		 * the value we return to the vfs is one greater than the
++		 * one we use internally.
++		 */
++		if (dir_index)
++			dir_index--;
++
+ 		if (dir_index > 1) {
+ 			struct dir_table_slot dirtab_slot;
+ 
+@@ -3086,7 +3094,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 			if (p->header.flag & BT_INTERNAL) {
+ 				jfs_err("jfs_readdir: bad index table");
+ 				DT_PUTPAGE(mp);
+-				filp->f_pos = -1;
++				filp->f_pos = DIREND;
+ 				return 0;
+ 			}
+ 		} else {
+@@ -3094,7 +3102,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 				/*
+ 				 * self "."
+ 				 */
+-				filp->f_pos = 0;
++				filp->f_pos = 1;
+ 				if (filldir(dirent, ".", 1, 0, ip->i_ino,
+ 					    DT_DIR))
+ 					return 0;
+@@ -3102,7 +3110,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 			/*
+ 			 * parent ".."
+ 			 */
+-			filp->f_pos = 1;
++			filp->f_pos = 2;
+ 			if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR))
+ 				return 0;
+ 
+@@ -3123,24 +3131,25 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 		/*
+ 		 * Legacy filesystem - OS/2 & Linux JFS < 0.3.6
+ 		 *
+-		 * pn = index = 0:	First entry "."
+-		 * pn = 0; index = 1:	Second entry ".."
++		 * pn = 0; index = 1:	First entry "."
++		 * pn = 0; index = 2:	Second entry ".."
+ 		 * pn > 0:		Real entries, pn=1 -> leftmost page
+ 		 * pn = index = -1:	No more entries
+ 		 */
+ 		dtpos = filp->f_pos;
+-		if (dtpos == 0) {
++		if (dtpos < 2) {
+ 			/* build "." entry */
+ 
++			filp->f_pos = 1;
+ 			if (filldir(dirent, ".", 1, filp->f_pos, ip->i_ino,
+ 				    DT_DIR))
+ 				return 0;
+-			dtoffset->index = 1;
++			dtoffset->index = 2;
+ 			filp->f_pos = dtpos;
+ 		}
+ 
+ 		if (dtoffset->pn == 0) {
+-			if (dtoffset->index == 1) {
++			if (dtoffset->index == 2) {
+ 				/* build ".." entry */
+ 
+ 				if (filldir(dirent, "..", 2, filp->f_pos,
+@@ -3233,6 +3242,12 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ 					}
+ 					jfs_dirent->position = unique_pos++;
+ 				}
++				/*
++				 * We add 1 to the index because we may
++				 * use a value of 2 internally, and NFSv4
++				 * doesn't like that.
++				 */
++				jfs_dirent->position++;
+ 			} else {
+ 				jfs_dirent->position = dtpos;
+ 				len = min(d_namleft, DTLHDRDATALEN_LEGACY);
+diff --git a/include/linux/regmap.h b/include/linux/regmap.h
+index f91bb41..98c470ce 100644
+--- a/include/linux/regmap.h
++++ b/include/linux/regmap.h
+@@ -16,6 +16,7 @@
+ #include <linux/list.h>
+ #include <linux/rbtree.h>
+ #include <linux/err.h>
++#include <linux/bug.h>
+ 
+ struct module;
+ struct device;
+diff --git a/include/net/mac80211.h b/include/net/mac80211.h
+index 885898a..4e50d36 100644
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1484,6 +1484,7 @@ enum ieee80211_hw_flags {
+ 	IEEE80211_HW_SUPPORTS_RC_TABLE			= 1<<24,
+ 	IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF		= 1<<25,
+ 	IEEE80211_HW_TIMING_BEACON_ONLY			= 1<<26,
++	IEEE80211_HW_SUPPORTS_HT_CCK_RATES		= 1<<27,
+ };
+ 
+ /**
+diff --git a/ipc/msg.c b/ipc/msg.c
+index d0c6d96..f8fbe2c 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -795,7 +795,7 @@ static inline void free_copy(struct msg_msg *copy)
+ 
+ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ {
+-	struct msg_msg *msg;
++	struct msg_msg *msg, *found = NULL;
+ 	long count = 0;
+ 
+ 	list_for_each_entry(msg, &msq->q_messages, m_list) {
+@@ -804,6 +804,7 @@ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ 					       *msgtyp, mode)) {
+ 			if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
+ 				*msgtyp = msg->m_type - 1;
++				found = msg;
+ 			} else if (mode == SEARCH_NUMBER) {
+ 				if (*msgtyp == count)
+ 					return msg;
+@@ -813,7 +814,7 @@ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ 		}
+ 	}
+ 
+-	return ERR_PTR(-EAGAIN);
++	return found ?: ERR_PTR(-EAGAIN);
+ }
+ 
+ 
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index 3bdf283..61ed862 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -265,10 +265,9 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
+ static int timer_list_show(struct seq_file *m, void *v)
+ {
+ 	struct timer_list_iter *iter = v;
+-	u64 now = ktime_to_ns(ktime_get());
+ 
+ 	if (iter->cpu == -1 && !iter->second_pass)
+-		timer_list_header(m, now);
++		timer_list_header(m, iter->now);
+ 	else if (!iter->second_pass)
+ 		print_cpu(m, iter->cpu, iter->now);
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+@@ -298,33 +297,41 @@ void sysrq_timer_list_show(void)
+ 	return;
+ }
+ 
+-static void *timer_list_start(struct seq_file *file, loff_t *offset)
++static void *move_iter(struct timer_list_iter *iter, loff_t offset)
+ {
+-	struct timer_list_iter *iter = file->private;
+-
+-	if (!*offset) {
+-		iter->cpu = -1;
+-		iter->now = ktime_to_ns(ktime_get());
+-	} else if (iter->cpu >= nr_cpu_ids) {
++	for (; offset; offset--) {
++		iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
++		if (iter->cpu >= nr_cpu_ids) {
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+-		if (!iter->second_pass) {
+-			iter->cpu = -1;
+-			iter->second_pass = true;
+-		} else
+-			return NULL;
++			if (!iter->second_pass) {
++				iter->cpu = -1;
++				iter->second_pass = true;
++			} else
++				return NULL;
+ #else
+-		return NULL;
++			return NULL;
+ #endif
++		}
+ 	}
+ 	return iter;
+ }
+ 
++static void *timer_list_start(struct seq_file *file, loff_t *offset)
++{
++	struct timer_list_iter *iter = file->private;
++
++	if (!*offset)
++		iter->now = ktime_to_ns(ktime_get());
++	iter->cpu = -1;
++	iter->second_pass = false;
++	return move_iter(iter, *offset);
++}
++
+ static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset)
+ {
+ 	struct timer_list_iter *iter = file->private;
+-	iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
+ 	++*offset;
+-	return timer_list_start(file, offset);
++	return move_iter(iter, 1);
+ }
+ 
+ static void timer_list_stop(struct seq_file *seq, void *v)
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 6f01921..e52d002 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2188,6 +2188,15 @@ __acquires(&pool->lock)
+ 		dump_stack();
+ 	}
+ 
++	/*
++	 * The following prevents a kworker from hogging CPU on !PREEMPT
++	 * kernels, where a requeueing work item waiting for something to
++	 * happen could deadlock with stop_machine as such work item could
++	 * indefinitely requeue itself while all other CPUs are trapped in
++	 * stop_machine.
++	 */
++	cond_resched();
++
+ 	spin_lock_irq(&pool->lock);
+ 
+ 	/* clear cpu intensive status */
+diff --git a/mm/slab.h b/mm/slab.h
+index f96b49e..4d6d836 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -162,6 +162,8 @@ static inline const char *cache_name(struct kmem_cache *s)
+ 
+ static inline struct kmem_cache *cache_from_memcg(struct kmem_cache *s, int idx)
+ {
++	if (!s->memcg_params)
++		return NULL;
+ 	return s->memcg_params->memcg_caches[idx];
+ }
+ 
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 170f9a7..3052672 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1166,6 +1166,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+ 	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+ 	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+ 						BSS_CHANGED_IBSS);
++	ieee80211_vif_release_channel(sdata);
+ 	synchronize_rcu();
+ 	kfree(presp);
+ 
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index f5aed96..f3bbea1 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -828,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+ 	if (sband->band != IEEE80211_BAND_2GHZ)
+ 		return;
+ 
++	if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
++		return;
++
+ 	mi->cck_supported = 0;
+ 	mi->cck_supported_short = 0;
+ 	for (i = 0; i < 4; i++) {
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 75edcfa..1504bb1 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -207,10 +207,13 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base,
+ 		pgfrom_base -= copy;
+ 
+ 		vto = kmap_atomic(*pgto);
+-		vfrom = kmap_atomic(*pgfrom);
+-		memmove(vto + pgto_base, vfrom + pgfrom_base, copy);
++		if (*pgto != *pgfrom) {
++			vfrom = kmap_atomic(*pgfrom);
++			memcpy(vto + pgto_base, vfrom + pgfrom_base, copy);
++			kunmap_atomic(vfrom);
++		} else
++			memmove(vto + pgto_base, vto + pgfrom_base, copy);
+ 		flush_dcache_page(*pgto);
+-		kunmap_atomic(vfrom);
+ 		kunmap_atomic(vto);
+ 
+ 	} while ((len -= copy) != 0);
+diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
+index b41ed86..e427dbf 100644
+--- a/sound/isa/opti9xx/opti92x-ad1848.c
++++ b/sound/isa/opti9xx/opti92x-ad1848.c
+@@ -173,11 +173,7 @@ MODULE_DEVICE_TABLE(pnp_card, snd_opti9xx_pnpids);
+ 
+ #endif	/* CONFIG_PNP */
+ 
+-#ifdef OPTi93X
+-#define DEV_NAME "opti93x"
+-#else
+-#define DEV_NAME "opti92x"
+-#endif
++#define DEV_NAME KBUILD_MODNAME
+ 
+ static char * snd_opti9xx_names[] = {
+ 	"unknown",
+@@ -1168,7 +1164,7 @@ static int snd_opti9xx_pnp_resume(struct pnp_card_link *pcard)
+ 
+ static struct pnp_card_driver opti9xx_pnpc_driver = {
+ 	.flags		= PNP_DRIVER_RES_DISABLE,
+-	.name		= "opti9xx",
++	.name		= DEV_NAME,
+ 	.id_table	= snd_opti9xx_pnpids,
+ 	.probe		= snd_opti9xx_pnp_probe,
+ 	.remove		= snd_opti9xx_pnp_remove,
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 496d7f2..5bc4194 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1715,6 +1715,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
+ 		struct snd_pcm_chmap *chmap;
+ 		struct snd_kcontrol *kctl;
+ 		int i;
++
++		if (!codec->pcm_info[pin_idx].pcm)
++			break;
+ 		err = snd_pcm_add_chmap_ctls(codec->pcm_info[pin_idx].pcm,
+ 					     SNDRV_PCM_STREAM_PLAYBACK,
+ 					     NULL, 0, pin_idx, &chmap);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 57f9f2a..458cf89 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4207,6 +4207,7 @@ static const struct hda_fixup alc662_fixups[] = {
+ 
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1019, 0x9087, "ECS", ALC662_FIXUP_ASUS_MODE2),
++	SND_PCI_QUIRK(0x1025, 0x022f, "Acer Aspire One", ALC662_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
+ 	SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),