Linux patch 3.15.83.15-10

2 files changed, 1018 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index afe4465e..bab5745e 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch:  1006_linux-3.15.7.patch
 From:   http://www.kernel.org
 Desc:   Linux 3.15.7
 
+Patch:  1007_linux-3.15.8.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.15.8
+
 Patch:  1700_enable-thinkpad-micled.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=449248
 Desc:   Enable mic mute led in thinkpads
diff --git a/1007_linux-3.15.8.patch b/1007_linux-3.15.8.patch
new file mode 100644
index 00000000..f0d7a6d8
--- /dev/null
+++ b/1007_linux-3.15.8.patch
@@ -0,0 +1,1014 @@
+diff --git a/Makefile b/Makefile
+index 833f67f3f80f..d5d9a22a404a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,8 +1,8 @@
+ VERSION = 3
+ PATCHLEVEL = 15
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+-NAME = Shuffling Zombie Juror
++NAME = Double Funky Skunk
+ 
+ # *DOCUMENTATION*
+ # To see a list of typical targets execute "make help"
+@@ -669,6 +669,8 @@ KBUILD_CFLAGS	+= -fomit-frame-pointer
+ endif
+ endif
+ 
++KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
++
+ ifdef CONFIG_DEBUG_INFO
+ KBUILD_CFLAGS	+= -g
+ KBUILD_AFLAGS	+= -Wa,--gdwarf-2
+diff --git a/arch/parisc/include/uapi/asm/signal.h b/arch/parisc/include/uapi/asm/signal.h
+index a2fa297196bc..f5645d6a89f2 100644
+--- a/arch/parisc/include/uapi/asm/signal.h
++++ b/arch/parisc/include/uapi/asm/signal.h
+@@ -69,8 +69,6 @@
+ #define SA_NOMASK	SA_NODEFER
+ #define SA_ONESHOT	SA_RESETHAND
+ 
+-#define SA_RESTORER	0x04000000 /* obsolete -- ignored */
+-
+ #define MINSIGSTKSZ	2048
+ #define SIGSTKSZ	8192
+ 
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 022b38e6a80b..2d0b4d68a40a 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -86,6 +86,7 @@ static struct device_node *dlpar_parse_cc_node(struct cc_workarea *ccwa,
+ 	}
+ 
+ 	of_node_set_flag(dn, OF_DYNAMIC);
++	of_node_init(dn);
+ 
+ 	return dn;
+ }
+diff --git a/arch/powerpc/platforms/pseries/reconfig.c b/arch/powerpc/platforms/pseries/reconfig.c
+index 0435bb65d0aa..1c0a60d98867 100644
+--- a/arch/powerpc/platforms/pseries/reconfig.c
++++ b/arch/powerpc/platforms/pseries/reconfig.c
+@@ -69,6 +69,7 @@ static int pSeries_reconfig_add_node(const char *path, struct property *proplist
+ 
+ 	np->properties = proplist;
+ 	of_node_set_flag(np, OF_DYNAMIC);
++	of_node_init(np);
+ 
+ 	np->parent = derive_parent(path);
+ 	if (IS_ERR(np->parent)) {
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 1c82619eb4f7..8c390e7a525a 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -334,9 +334,14 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ 			unsigned long mask = PSW_MASK_USER;
+ 
+ 			mask |= is_ri_task(child) ? PSW_MASK_RI : 0;
+-			if ((data & ~mask) != PSW_USER_BITS)
++			if ((data ^ PSW_USER_BITS) & ~mask)
++				/* Invalid psw mask. */
++				return -EINVAL;
++			if ((data & PSW_MASK_ASC) == PSW_ASC_HOME)
++				/* Invalid address-space-control bits */
+ 				return -EINVAL;
+ 			if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))
++				/* Invalid addressing mode bits */
+ 				return -EINVAL;
+ 		}
+ 		*(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
+@@ -672,9 +677,12 @@ static int __poke_user_compat(struct task_struct *child,
+ 
+ 			mask |= is_ri_task(child) ? PSW32_MASK_RI : 0;
+ 			/* Build a 64 bit psw mask from 31 bit mask. */
+-			if ((tmp & ~mask) != PSW32_USER_BITS)
++			if ((tmp ^ PSW32_USER_BITS) & ~mask)
+ 				/* Invalid psw mask. */
+ 				return -EINVAL;
++			if ((data & PSW32_MASK_ASC) == PSW32_ASC_HOME)
++				/* Invalid address-space-control bits */
++				return -EINVAL;
+ 			regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+ 				(regs->psw.mask & PSW_MASK_BA) |
+ 				(__u64)(tmp & mask) << 32;
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index 6491353cc9aa..c87810b1b557 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -433,8 +433,8 @@ sysenter_do_call:
+ 	cmpl $(NR_syscalls), %eax
+ 	jae sysenter_badsys
+ 	call *sys_call_table(,%eax,4)
+-	movl %eax,PT_EAX(%esp)
+ sysenter_after_call:
++	movl %eax,PT_EAX(%esp)
+ 	LOCKDEP_SYS_EXIT
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
+ 	TRACE_IRQS_OFF
+@@ -514,6 +514,7 @@ ENTRY(system_call)
+ 	jae syscall_badsys
+ syscall_call:
+ 	call *sys_call_table(,%eax,4)
++syscall_after_call:
+ 	movl %eax,PT_EAX(%esp)		# store the return value
+ syscall_exit:
+ 	LOCKDEP_SYS_EXIT
+@@ -683,12 +684,12 @@ syscall_fault:
+ END(syscall_fault)
+ 
+ syscall_badsys:
+-	movl $-ENOSYS,PT_EAX(%esp)
+-	jmp syscall_exit
++	movl $-ENOSYS,%eax
++	jmp syscall_after_call
+ END(syscall_badsys)
+ 
+ sysenter_badsys:
+-	movl $-ENOSYS,PT_EAX(%esp)
++	movl $-ENOSYS,%eax
+ 	jmp sysenter_after_call
+ END(syscall_badsys)
+ 	CFI_ENDPROC
+diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
+index 4224256bb215..77ed20209ca5 100644
+--- a/arch/xtensa/mm/init.c
++++ b/arch/xtensa/mm/init.c
+@@ -191,7 +191,7 @@ int __init mem_reserve(unsigned long start, unsigned long end, int must_exist)
+ 		return -EINVAL;
+ 	}
+ 
+-	if (it && start - it->start < bank_sz) {
++	if (it && start - it->start <= bank_sz) {
+ 		if (start == it->start) {
+ 			if (end - it->start < bank_sz) {
+ 				it->start = end;
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 95ee425bf7c6..f1e380368372 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -872,6 +872,13 @@ void blkcg_drain_queue(struct request_queue *q)
+ {
+ 	lockdep_assert_held(q->queue_lock);
+ 
++	/*
++	 * @q could be exiting and already have destroyed all blkgs as
++	 * indicated by NULL root_blkg.  If so, don't confuse policies.
++	 */
++	if (!q->root_blkg)
++		return;
++
+ 	blk_throtl_drain(q);
+ }
+ 
+diff --git a/block/blk-tag.c b/block/blk-tag.c
+index 3f33d8672268..a185b86741e5 100644
+--- a/block/blk-tag.c
++++ b/block/blk-tag.c
+@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struct request_queue *q, int tag)
+ EXPORT_SYMBOL(blk_queue_find_tag);
+ 
+ /**
+- * __blk_free_tags - release a given set of tag maintenance info
++ * blk_free_tags - release a given set of tag maintenance info
+  * @bqt:	the tag map to free
+  *
+- * Tries to free the specified @bqt.  Returns true if it was
+- * actually freed and false if there are still references using it
++ * Drop the reference count on @bqt and frees it when the last reference
++ * is dropped.
+  */
+-static int __blk_free_tags(struct blk_queue_tag *bqt)
++void blk_free_tags(struct blk_queue_tag *bqt)
+ {
+-	int retval;
+-
+-	retval = atomic_dec_and_test(&bqt->refcnt);
+-	if (retval) {
++	if (atomic_dec_and_test(&bqt->refcnt)) {
+ 		BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
+ 							bqt->max_depth);
+ 
+@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_queue_tag *bqt)
+ 
+ 		kfree(bqt);
+ 	}
+-
+-	return retval;
+ }
++EXPORT_SYMBOL(blk_free_tags);
+ 
+ /**
+  * __blk_queue_free_tags - release tag maintenance info
+@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct request_queue *q)
+ 	if (!bqt)
+ 		return;
+ 
+-	__blk_free_tags(bqt);
++	blk_free_tags(bqt);
+ 
+ 	q->queue_tags = NULL;
+ 	queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
+ }
+ 
+ /**
+- * blk_free_tags - release a given set of tag maintenance info
+- * @bqt:	the tag map to free
+- *
+- * For externally managed @bqt frees the map.  Callers of this
+- * function must guarantee to have released all the queues that
+- * might have been using this tag map.
+- */
+-void blk_free_tags(struct blk_queue_tag *bqt)
+-{
+-	if (unlikely(!__blk_free_tags(bqt)))
+-		BUG();
+-}
+-EXPORT_SYMBOL(blk_free_tags);
+-
+-/**
+  * blk_queue_free_tags - release tag maintenance info
+  * @q:  the request queue for the device
+  *
+diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
+index fbd5a67cb773..a0926a6094b2 100644
+--- a/block/compat_ioctl.c
++++ b/block/compat_ioctl.c
+@@ -690,6 +690,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ 	case BLKROSET:
+ 	case BLKDISCARD:
+ 	case BLKSECDISCARD:
++	case BLKZEROOUT:
+ 	/*
+ 	 * the ones below are implemented in blkdev_locked_ioctl,
+ 	 * but we call blkdev_ioctl, which gets the lock for us
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index dae5607e1115..4cd52a4541a9 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -456,6 +456,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 
+ 	/* Promise */
+ 	{ PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },	/* PDC42819 */
++	{ PCI_VDEVICE(PROMISE, 0x3781), board_ahci },   /* FastTrak TX8660 ahci-mode */
+ 
+ 	/* Asmedia */
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },	/* ASM1060 */
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 18d97d5c7d90..677c0c1b03bd 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4787,6 +4787,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+  *	ata_qc_new - Request an available ATA command, for queueing
+  *	@ap: target port
+  *
++ *	Some ATA host controllers may implement a queue depth which is less
++ *	than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
++ *	the hardware limitation.
++ *
+  *	LOCKING:
+  *	None.
+  */
+@@ -4794,14 +4798,15 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ 	struct ata_queued_cmd *qc = NULL;
++	unsigned int max_queue = ap->host->n_tags;
+ 	unsigned int i, tag;
+ 
+ 	/* no command while frozen */
+ 	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
+ 		return NULL;
+ 
+-	for (i = 0; i < ATA_MAX_QUEUE; i++) {
+-		tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
++	for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
++		tag = tag < max_queue ? tag : 0;
+ 
+ 		/* the last tag is reserved for internal command. */
+ 		if (tag == ATA_TAG_INTERNAL)
+@@ -6088,6 +6093,7 @@ void ata_host_init(struct ata_host *host, struct device *dev,
+ {
+ 	spin_lock_init(&host->lock);
+ 	mutex_init(&host->eh_mutex);
++	host->n_tags = ATA_MAX_QUEUE - 1;
+ 	host->dev = dev;
+ 	host->ops = ops;
+ }
+@@ -6169,6 +6175,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
+ {
+ 	int i, rc;
+ 
++	host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1);
++
+ 	/* host must have been started */
+ 	if (!(host->flags & ATA_HOST_STARTED)) {
+ 		dev_err(host->dev, "BUG: trying to register unstarted host\n");
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 5b47210889e0..cd2a7d0a56b2 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -89,8 +89,13 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
+ 	return dev->archdata.irqs[num];
+ #else
+ 	struct resource *r;
+-	if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
+-		return of_irq_get(dev->dev.of_node, num);
++	if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
++		int ret;
++
++		ret = of_irq_get(dev->dev.of_node, num);
++		if (ret >= 0 || ret == -EPROBE_DEFER)
++			return ret;
++	}
+ 
+ 	r = platform_get_resource(dev, IORESOURCE_IRQ, num);
+ 
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 089e72cd37be..36e54be402df 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -622,11 +622,18 @@ static void zram_reset_device(struct zram *zram, bool reset_capacity)
+ 	memset(&zram->stats, 0, sizeof(zram->stats));
+ 
+ 	zram->disksize = 0;
+-	if (reset_capacity) {
++	if (reset_capacity)
+ 		set_capacity(zram->disk, 0);
+-		revalidate_disk(zram->disk);
+-	}
++
+ 	up_write(&zram->init_lock);
++
++	/*
++	 * Revalidate disk out of the init_lock to avoid lockdep splat.
++	 * It's okay because disk's capacity is protected by init_lock
++	 * so that revalidate_disk always sees up-to-date capacity.
++	 */
++	if (reset_capacity)
++		revalidate_disk(zram->disk);
+ }
+ 
+ static ssize_t disksize_store(struct device *dev,
+@@ -666,8 +673,15 @@ static ssize_t disksize_store(struct device *dev,
+ 	zram->comp = comp;
+ 	zram->disksize = disksize;
+ 	set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT);
+-	revalidate_disk(zram->disk);
+ 	up_write(&zram->init_lock);
++
++	/*
++	 * Revalidate disk out of the init_lock to avoid lockdep splat.
++	 * It's okay because disk's capacity is protected by init_lock
++	 * so that revalidate_disk always sees up-to-date capacity.
++	 */
++	revalidate_disk(zram->disk);
++
+ 	return len;
+ 
+ out_destroy_comp:
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index 2a451b14b3cc..c4419ea1ab07 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -68,6 +68,12 @@ static void add_early_randomness(struct hwrng *rng)
+ 	unsigned char bytes[16];
+ 	int bytes_read;
+ 
++	/*
++	 * Currently only virtio-rng cannot return data during device
++	 * probe, and that's handled in virtio-rng.c itself.  If there
++	 * are more such devices, this call to rng_get_data can be
++	 * made conditional here instead of doing it per-device.
++	 */
+ 	bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+ 	if (bytes_read > 0)
+ 		add_device_randomness(bytes, bytes_read);
+diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
+index 2ce0e225e58c..e4ecf99971fe 100644
+--- a/drivers/char/hw_random/virtio-rng.c
++++ b/drivers/char/hw_random/virtio-rng.c
+@@ -30,6 +30,8 @@ static unsigned int data_avail;
+ static DECLARE_COMPLETION(have_data);
+ static bool busy;
+ 
++static bool probe_done;
++
+ static void random_recv_done(struct virtqueue *vq)
+ {
+ 	/* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
+@@ -56,6 +58,13 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
+ {
+ 	int ret;
+ 
++	/*
++	 * Don't ask host for data till we're setup.  This call can
++	 * happen during hwrng_register(), after commit d9e7972619.
++	 */
++	if (unlikely(!probe_done))
++		return 0;
++
+ 	if (!busy) {
+ 		busy = true;
+ 		init_completion(&have_data);
+@@ -110,6 +119,7 @@ static int probe_common(struct virtio_device *vdev)
+ 		return err;
+ 	}
+ 
++	probe_done = true;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index d2fd98968085..03ff689229ff 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -2290,6 +2290,7 @@ static void cik_tiling_mode_table_init(struct radeon_device *rdev)
+ 				gb_tile_moden = 0;
+ 				break;
+ 			}
++			rdev->config.cik.macrotile_mode_array[reg_offset] = gb_tile_moden;
+ 			WREG32(GB_MACROTILE_MODE0 + (reg_offset * 4), gb_tile_moden);
+ 		}
+ 	} else if (num_pipe_configs == 8) {
+@@ -7363,6 +7364,7 @@ static inline u32 cik_get_ih_wptr(struct radeon_device *rdev)
+ 		tmp = RREG32(IH_RB_CNTL);
+ 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ 		WREG32(IH_RB_CNTL, tmp);
++		wptr &= ~RB_OVERFLOW;
+ 	}
+ 	return (wptr & rdev->ih.ptr_mask);
+ }
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index a61a9039f6f6..9da5a9506d60 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -4759,6 +4759,7 @@ static u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
+ 		tmp = RREG32(IH_RB_CNTL);
+ 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ 		WREG32(IH_RB_CNTL, tmp);
++		wptr &= ~RB_OVERFLOW;
+ 	}
+ 	return (wptr & rdev->ih.ptr_mask);
+ }
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index bbc189fd3ddc..7600a432d702 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3792,6 +3792,7 @@ static u32 r600_get_ih_wptr(struct radeon_device *rdev)
+ 		tmp = RREG32(IH_RB_CNTL);
+ 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ 		WREG32(IH_RB_CNTL, tmp);
++		wptr &= ~RB_OVERFLOW;
+ 	}
+ 	return (wptr & rdev->ih.ptr_mask);
+ }
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 22a63c98ba14..70d4c7603c28 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6090,6 +6090,7 @@ static inline u32 si_get_ih_wptr(struct radeon_device *rdev)
+ 		tmp = RREG32(IH_RB_CNTL);
+ 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ 		WREG32(IH_RB_CNTL, tmp);
++		wptr &= ~RB_OVERFLOW;
+ 	}
+ 	return (wptr & rdev->ih.ptr_mask);
+ }
+diff --git a/drivers/hwmon/smsc47m192.c b/drivers/hwmon/smsc47m192.c
+index efee4c59239f..34b9a601ad07 100644
+--- a/drivers/hwmon/smsc47m192.c
++++ b/drivers/hwmon/smsc47m192.c
+@@ -86,7 +86,7 @@ static inline u8 IN_TO_REG(unsigned long val, int n)
+  */
+ static inline s8 TEMP_TO_REG(int val)
+ {
+-	return clamp_val(SCALE(val, 1, 1000), -128000, 127000);
++	return SCALE(clamp_val(val, -128000, 127000), 1, 1000);
+ }
+ 
+ static inline int TEMP_FROM_REG(s8 val)
+@@ -384,6 +384,8 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
+ 	err = kstrtoul(buf, 10, &val);
+ 	if (err)
+ 		return err;
++	if (val > 255)
++		return -EINVAL;
+ 
+ 	data->vrm = val;
+ 	return count;
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index 1c4c0db05550..29ca0bb4f561 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -257,9 +257,10 @@ static int input_handle_abs_event(struct input_dev *dev,
+ }
+ 
+ static int input_get_disposition(struct input_dev *dev,
+-			  unsigned int type, unsigned int code, int value)
++			  unsigned int type, unsigned int code, int *pval)
+ {
+ 	int disposition = INPUT_IGNORE_EVENT;
++	int value = *pval;
+ 
+ 	switch (type) {
+ 
+@@ -357,6 +358,7 @@ static int input_get_disposition(struct input_dev *dev,
+ 		break;
+ 	}
+ 
++	*pval = value;
+ 	return disposition;
+ }
+ 
+@@ -365,7 +367,7 @@ static void input_handle_event(struct input_dev *dev,
+ {
+ 	int disposition;
+ 
+-	disposition = input_get_disposition(dev, type, code, value);
++	disposition = input_get_disposition(dev, type, code, &value);
+ 
+ 	if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event)
+ 		dev->event(dev, type, code, value);
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index ec772d962f06..ef9e0b8a9aa7 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -132,7 +132,8 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
+ 		1232, 5710, 1156, 4696
+ 	},
+ 	{
+-		(const char * const []){"LEN0034", "LEN0036", "LEN2004", NULL},
++		(const char * const []){"LEN0034", "LEN0036", "LEN2002",
++					"LEN2004", NULL},
+ 		1024, 5112, 2024, 4832
+ 	},
+ 	{
+@@ -168,7 +169,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
+ 	"LEN0049",
+ 	"LEN2000",
+ 	"LEN2001", /* Edge E431 */
+-	"LEN2002",
++	"LEN2002", /* Edge E531 */
+ 	"LEN2003",
+ 	"LEN2004", /* L440 */
+ 	"LEN2005",
+diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
+index 522fe00f5eee..49874e76548b 100644
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -668,6 +668,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
+ 	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ 	int ret, i;
+ 	u8 mode, rolloff, pilot, inversion, div;
++	fe_modulation_t modulation;
+ 
+ 	dev_dbg(&priv->i2c->dev,
+ 			"%s: delivery_system=%d modulation=%d frequency=%d symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n",
+@@ -702,10 +703,13 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
+ 
+ 	switch (c->delivery_system) {
+ 	case SYS_DVBS:
++		modulation = QPSK;
+ 		rolloff = 0;
+ 		pilot = 2;
+ 		break;
+ 	case SYS_DVBS2:
++		modulation = c->modulation;
++
+ 		switch (c->rolloff) {
+ 		case ROLLOFF_20:
+ 			rolloff = 2;
+@@ -750,7 +754,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
+ 
+ 	for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
+ 		if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
+-			c->modulation == TDA10071_MODCOD[i].modulation &&
++			modulation == TDA10071_MODCOD[i].modulation &&
+ 			c->fec_inner == TDA10071_MODCOD[i].fec) {
+ 			mode = TDA10071_MODCOD[i].val;
+ 			dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
+diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
+index 021e4d35e4d7..7b9b75f60774 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -704,15 +704,41 @@ static int af9035_read_config(struct dvb_usb_device *d)
+ 		if (ret < 0)
+ 			goto err;
+ 
+-		if (tmp == 0x00)
+-			dev_dbg(&d->udev->dev,
+-					"%s: [%d]tuner not set, using default\n",
+-					__func__, i);
+-		else
++		dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
++				__func__, i, tmp);
++
++		/* tuner sanity check */
++		if (state->chip_type == 0x9135) {
++			if (state->chip_version == 0x02) {
++				/* IT9135 BX (v2) */
++				switch (tmp) {
++				case AF9033_TUNER_IT9135_60:
++				case AF9033_TUNER_IT9135_61:
++				case AF9033_TUNER_IT9135_62:
++					state->af9033_config[i].tuner = tmp;
++					break;
++				}
++			} else {
++				/* IT9135 AX (v1) */
++				switch (tmp) {
++				case AF9033_TUNER_IT9135_38:
++				case AF9033_TUNER_IT9135_51:
++				case AF9033_TUNER_IT9135_52:
++					state->af9033_config[i].tuner = tmp;
++					break;
++				}
++			}
++		} else {
++			/* AF9035 */
+ 			state->af9033_config[i].tuner = tmp;
++		}
+ 
+-		dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
+-				__func__, i, state->af9033_config[i].tuner);
++		if (state->af9033_config[i].tuner != tmp) {
++			dev_info(&d->udev->dev,
++					"%s: [%d] overriding tuner from %02x to %02x\n",
++					KBUILD_MODNAME, i, tmp,
++					state->af9033_config[i].tuner);
++		}
+ 
+ 		switch (state->af9033_config[i].tuner) {
+ 		case AF9033_TUNER_TUA9001:
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index 0500c4175d5f..6bce01a674f9 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(struct urb *urb)
+ }
+ 
+ /*=========================================================================*/
+-/* bufffer bits */
++/* buffer bits */
+ 
+ /* function expects dev->io_mutex to be hold by caller */
+ int hdpvr_cancel_queue(struct hdpvr_device *dev)
+@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl *ctrl)
+ 	case V4L2_CID_MPEG_AUDIO_ENCODING:
+ 		if (dev->flags & HDPVR_FLAG_AC3_CAP) {
+ 			opt->audio_codec = ctrl->val;
+-			return hdpvr_set_audio(dev, opt->audio_input,
++			return hdpvr_set_audio(dev, opt->audio_input + 1,
+ 					      opt->audio_codec);
+ 		}
+ 		return 0;
+@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
+ 	v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
+ 		V4L2_CID_MPEG_AUDIO_ENCODING,
+ 		ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
+-		0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
++		0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
+ 	v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
+ 		V4L2_CID_MPEG_VIDEO_ENCODING,
+ 		V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index 48b20dfcc4d0..eb3850c246a6 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -599,10 +599,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio(u8 hor_landscape, u8 vert_portrait)
+ 		aspect.denominator = 9;
+ 	} else if (ratio == 34) {
+ 		aspect.numerator = 4;
+-		aspect.numerator = 3;
++		aspect.denominator = 3;
+ 	} else if (ratio == 68) {
+ 		aspect.numerator = 15;
+-		aspect.numerator = 9;
++		aspect.denominator = 9;
+ 	} else {
+ 		aspect.numerator = hor_landscape + 99;
+ 		aspect.denominator = 100;
+diff --git a/drivers/parport/Kconfig b/drivers/parport/Kconfig
+index 2872ece81f35..44333bd8f908 100644
+--- a/drivers/parport/Kconfig
++++ b/drivers/parport/Kconfig
+@@ -5,6 +5,12 @@
+ # Parport configuration.
+ #
+ 
++config ARCH_MIGHT_HAVE_PC_PARPORT
++	bool
++	help
++	  Select this config option from the architecture Kconfig if
++	  the architecture might have PC parallel port hardware.
++
+ menuconfig PARPORT
+ 	tristate "Parallel port support"
+ 	depends on HAS_IOMEM
+@@ -31,12 +37,6 @@ menuconfig PARPORT
+ 
+ 	  If unsure, say Y.
+ 
+-config ARCH_MIGHT_HAVE_PC_PARPORT
+-	bool
+-	help
+-	  Select this config option from the architecture Kconfig if
+-	  the architecture might have PC parallel port hardware.
+-
+ if PARPORT
+ 
+ config PARPORT_PC
+diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
+index bd725b0a4341..3a364686c112 100644
+--- a/drivers/pinctrl/pinctrl-st.c
++++ b/drivers/pinctrl/pinctrl-st.c
+@@ -1467,7 +1467,7 @@ static void st_gpio_irqmux_handler(unsigned irq, struct irq_desc *desc)
+ 
+ 	status = readl(info->irqmux_base);
+ 
+-	for_each_set_bit(n, &status, ST_GPIO_PINS_PER_BANK)
++	for_each_set_bit(n, &status, info->nbanks)
+ 		__gpio_irq_handler(&info->banks[n]);
+ 
+ 	chained_irq_exit(chip, desc);
+diff --git a/drivers/staging/media/omap4iss/Kconfig b/drivers/staging/media/omap4iss/Kconfig
+index b9fe753969bd..15940f8fdd24 100644
+--- a/drivers/staging/media/omap4iss/Kconfig
++++ b/drivers/staging/media/omap4iss/Kconfig
+@@ -1,6 +1,6 @@
+ config VIDEO_OMAP4
+ 	bool "OMAP 4 Camera support"
+-	depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && I2C && ARCH_OMAP4
++	depends on VIDEO_V4L2=y && VIDEO_V4L2_SUBDEV_API && I2C=y && ARCH_OMAP4
+ 	select VIDEOBUF2_DMA_CONTIG
+ 	---help---
+ 	  Driver for an OMAP 4 ISS controller.
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 0b2528fb640e..a93f7e6ea4cf 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -306,7 +306,7 @@ static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
+ 	if (unlikely(nr < 0))
+ 		return nr;
+ 
+-	tsk->flags = PF_DUMPCORE;
++	tsk->flags |= PF_DUMPCORE;
+ 	if (atomic_read(&mm->mm_users) == nr + 1)
+ 		goto done;
+ 	/*
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index e2cd799e4d21..2d9c1d071a7a 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -907,9 +907,6 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
+ 				fc->writeback_cache = 1;
+ 			if (arg->time_gran && arg->time_gran <= 1000000000)
+ 				fc->sb->s_time_gran = arg->time_gran;
+-			else
+-				fc->sb->s_time_gran = 1000000000;
+-
+ 		} else {
+ 			ra_pages = fc->max_read / PAGE_CACHE_SIZE;
+ 			fc->no_lock = 1;
+@@ -938,7 +935,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
+ 		FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
+ 		FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
+ 		FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
+-		FUSE_WRITEBACK_CACHE;
++		FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT;
+ 	req->in.h.opcode = FUSE_INIT;
+ 	req->in.numargs = 1;
+ 	req->in.args[0].size = sizeof(*arg);
+diff --git a/fs/namei.c b/fs/namei.c
+index 985c6f368485..9eb787e5c167 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2256,9 +2256,10 @@ done:
+ 		goto out;
+ 	}
+ 	path->dentry = dentry;
+-	path->mnt = mntget(nd->path.mnt);
++	path->mnt = nd->path.mnt;
+ 	if (should_follow_link(dentry, nd->flags & LOOKUP_FOLLOW))
+ 		return 1;
++	mntget(path->mnt);
+ 	follow_mount(path);
+ 	error = 0;
+ out:
+diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
+index 871d6eda8dba..8f854dde4150 100644
+--- a/fs/nfs/nfs3acl.c
++++ b/fs/nfs/nfs3acl.c
+@@ -247,3 +247,46 @@ const struct xattr_handler *nfs3_xattr_handlers[] = {
+ 	&posix_acl_default_xattr_handler,
+ 	NULL,
+ };
++
++static int
++nfs3_list_one_acl(struct inode *inode, int type, const char *name, void *data,
++		size_t size, ssize_t *result)
++{
++	struct posix_acl *acl;
++	char *p = data + *result;
++
++	acl = get_acl(inode, type);
++	if (!acl)
++		return 0;
++
++	posix_acl_release(acl);
++
++	*result += strlen(name);
++	*result += 1;
++	if (!size)
++		return 0;
++	if (*result > size)
++		return -ERANGE;
++
++	strcpy(p, name);
++	return 0;
++}
++
++ssize_t
++nfs3_listxattr(struct dentry *dentry, char *data, size_t size)
++{
++	struct inode *inode = dentry->d_inode;
++	ssize_t result = 0;
++	int error;
++
++	error = nfs3_list_one_acl(inode, ACL_TYPE_ACCESS,
++			POSIX_ACL_XATTR_ACCESS, data, size, &result);
++	if (error)
++		return error;
++
++	error = nfs3_list_one_acl(inode, ACL_TYPE_DEFAULT,
++			POSIX_ACL_XATTR_DEFAULT, data, size, &result);
++	if (error)
++		return error;
++	return result;
++}
+diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
+index db60149c4579..0e2bb2658c94 100644
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -891,7 +891,7 @@ static const struct inode_operations nfs3_dir_inode_operations = {
+ 	.getattr	= nfs_getattr,
+ 	.setattr	= nfs_setattr,
+ #ifdef CONFIG_NFS_V3_ACL
+-	.listxattr	= generic_listxattr,
++	.listxattr	= nfs3_listxattr,
+ 	.getxattr	= generic_getxattr,
+ 	.setxattr	= generic_setxattr,
+ 	.removexattr	= generic_removexattr,
+@@ -905,7 +905,7 @@ static const struct inode_operations nfs3_file_inode_operations = {
+ 	.getattr	= nfs_getattr,
+ 	.setattr	= nfs_setattr,
+ #ifdef CONFIG_NFS_V3_ACL
+-	.listxattr	= generic_listxattr,
++	.listxattr	= nfs3_listxattr,
+ 	.getxattr	= generic_getxattr,
+ 	.setxattr	= generic_setxattr,
+ 	.removexattr	= generic_removexattr,
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 5ab4e3a76721..92abb497ab14 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -593,6 +593,7 @@ struct ata_host {
+ 	struct device 		*dev;
+ 	void __iomem * const	*iomap;
+ 	unsigned int		n_ports;
++	unsigned int		n_tags;			/* nr of NCQ tags */
+ 	void			*private_data;
+ 	struct ata_port_operations *ops;
+ 	unsigned long		flags;
+diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
+index 40b5ca8a1b1f..25084a052a1e 100644
+--- a/include/uapi/linux/fuse.h
++++ b/include/uapi/linux/fuse.h
+@@ -101,6 +101,7 @@
+  *  - add FATTR_CTIME
+  *  - add ctime and ctimensec to fuse_setattr_in
+  *  - add FUSE_RENAME2 request
++ *  - add FUSE_NO_OPEN_SUPPORT flag
+  */
+ 
+ #ifndef _LINUX_FUSE_H
+@@ -229,6 +230,7 @@ struct fuse_file_lock {
+  * FUSE_READDIRPLUS_AUTO: adaptive readdirplus
+  * FUSE_ASYNC_DIO: asynchronous direct I/O submission
+  * FUSE_WRITEBACK_CACHE: use writeback cache for buffered writes
++ * FUSE_NO_OPEN_SUPPORT: kernel supports zero-message opens
+  */
+ #define FUSE_ASYNC_READ		(1 << 0)
+ #define FUSE_POSIX_LOCKS	(1 << 1)
+@@ -247,6 +249,7 @@ struct fuse_file_lock {
+ #define FUSE_READDIRPLUS_AUTO	(1 << 14)
+ #define FUSE_ASYNC_DIO		(1 << 15)
+ #define FUSE_WRITEBACK_CACHE	(1 << 16)
++#define FUSE_NO_OPEN_SUPPORT	(1 << 17)
+ 
+ /**
+  * CUSE INIT request/reply flags
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 4dcbf7dc3c51..e1baa92f8013 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -823,7 +823,7 @@ static struct {
+ 	{ trace_clock_local,	"local",	1 },
+ 	{ trace_clock_global,	"global",	1 },
+ 	{ trace_clock_counter,	"counter",	0 },
+-	{ trace_clock_jiffies,	"uptime",	1 },
++	{ trace_clock_jiffies,	"uptime",	0 },
+ 	{ trace_clock,		"perf",		1 },
+ 	ARCH_TRACE_CLOCKS
+ };
+diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
+index 26dc348332b7..57b67b1f24d1 100644
+--- a/kernel/trace/trace_clock.c
++++ b/kernel/trace/trace_clock.c
+@@ -59,13 +59,14 @@ u64 notrace trace_clock(void)
+ 
+ /*
+  * trace_jiffy_clock(): Simply use jiffies as a clock counter.
++ * Note that this use of jiffies_64 is not completely safe on
++ * 32-bit systems. But the window is tiny, and the effect if
++ * we are affected is that we will have an obviously bogus
++ * timestamp on a trace event - i.e. not life threatening.
+  */
+ u64 notrace trace_clock_jiffies(void)
+ {
+-	u64 jiffy = jiffies - INITIAL_JIFFIES;
+-
+-	/* Return nsecs */
+-	return (u64)jiffies_to_usecs(jiffy) * 1000ULL;
++	return jiffies_64_to_clock_t(jiffies_64 - INITIAL_JIFFIES);
+ }
+ 
+ /*
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index a646f1598d58..002f08e3d61c 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2461,6 +2461,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ 		} else {
+ 			if (cow)
+ 				huge_ptep_set_wrprotect(src, addr, src_pte);
++			entry = huge_ptep_get(src_pte);
+ 			ptepage = pte_page(entry);
+ 			get_page(ptepage);
+ 			page_dup_rmap(ptepage);
+diff --git a/mm/memory.c b/mm/memory.c
+index e302ae1dcce0..4f9e53024b24 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3515,7 +3515,7 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	 * if page by the offset is not ready to be mapped (cold cache or
+ 	 * something).
+ 	 */
+-	if (vma->vm_ops->map_pages) {
++	if (vma->vm_ops->map_pages && !(flags & FAULT_FLAG_NONLINEAR)) {
+ 		pte = pte_offset_map_lock(mm, pmd, address, &ptl);
+ 		do_fault_around(vma, address, pte, pgoff, flags);
+ 		if (!pte_same(*pte, orig_pte))
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 102cc6fca3d3..b810fba0095d 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -55,7 +55,7 @@ static int kmem_cache_sanity_check(const char *name, size_t size)
+ 			continue;
+ 		}
+ 
+-#if !defined(CONFIG_SLUB) || !defined(CONFIG_SLUB_DEBUG_ON)
++#if !defined(CONFIG_SLUB)
+ 		if (!strcmp(s->name, name)) {
+ 			pr_err("%s (%s): Cache name already exists.\n",
+ 			       __func__, name);
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 052c1bf8ffac..8060b28dcef6 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -1470,18 +1470,17 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
+ 		}
+ 		CMD(start_p2p_device, START_P2P_DEVICE);
+ 		CMD(set_mcast_rate, SET_MCAST_RATE);
++#ifdef CONFIG_NL80211_TESTMODE
++		CMD(testmode_cmd, TESTMODE);
++#endif
+ 		if (state->split) {
+ 			CMD(crit_proto_start, CRIT_PROTOCOL_START);
+ 			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
+ 			if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
+ 				CMD(channel_switch, CHANNEL_SWITCH);
++			CMD(set_qos_map, SET_QOS_MAP);
+ 		}
+-		CMD(set_qos_map, SET_QOS_MAP);
+-
+-#ifdef CONFIG_NL80211_TESTMODE
+-		CMD(testmode_cmd, TESTMODE);
+-#endif
+-
++		/* add into the if now */
+ #undef CMD
+ 
+ 		if (dev->ops->connect || dev->ops->auth) {