diff --git a/Makefile b/Makefile
index fdd7c32ea1f7..d277446ee8ee 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 4
-SUBLEVEL = 97
+SUBLEVEL = 98
 EXTRAVERSION =
 NAME = Saber-toothed Squirrel
 
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index 65c33911341f..90b33c55ac1b 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -184,8 +184,10 @@ static int __init _omap_mux_get_by_name(struct 
omap_mux_partition *partition,
                m0_entry = mux->muxnames[0];
 
                /* First check for full name in mode0.muxmode format */
-               if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
-                       continue;
+               if (mode0_len)
+                       if (strncmp(muxname, m0_entry, mode0_len) ||
+                           (strlen(m0_entry) != mode0_len))
+                               continue;
 
                /* Then check for muxmode only */
                for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
diff --git a/arch/powerpc/kernel/exceptions-64s.S 
b/arch/powerpc/kernel/exceptions-64s.S
index 8f880bc77c56..846a16378d01 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -491,7 +491,7 @@ machine_check_common:
        STD_EXCEPTION_COMMON(0xb00, trap_0b, .unknown_exception)
        STD_EXCEPTION_COMMON(0xd00, single_step, .single_step_exception)
        STD_EXCEPTION_COMMON(0xe00, trap_0e, .unknown_exception)
-        STD_EXCEPTION_COMMON(0xe40, emulation_assist, .program_check_exception)
+       STD_EXCEPTION_COMMON(0xe40, emulation_assist, 
.emulation_assist_interrupt)
         STD_EXCEPTION_COMMON(0xe60, hmi_exception, .unknown_exception)
        STD_EXCEPTION_COMMON_ASYNC(0xf00, performance_monitor, 
.performance_monitor_exception)
        STD_EXCEPTION_COMMON(0x1300, instruction_breakpoint, 
.instruction_breakpoint_exception)
diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
index f5725bce9ed2..f62fda1b6d61 100644
--- a/arch/powerpc/kernel/lparcfg.c
+++ b/arch/powerpc/kernel/lparcfg.c
@@ -35,7 +35,13 @@
 #include <asm/vdso_datapage.h>
 #include <asm/vio.h>
 #include <asm/mmu.h>
+#include <asm/machdep.h>
 
+
+/*
+ * This isn't a module but we expose that to userspace
+ * via /proc so leave the definitions here
+ */
 #define MODULE_VERS "1.9"
 #define MODULE_NAME "lparcfg"
 
@@ -301,6 +307,7 @@ static void parse_system_parameter_string(struct seq_file 
*m)
                                __pa(rtas_data_buf),
                                RTAS_DATA_BUF_SIZE);
        memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
+       local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
        spin_unlock(&rtas_data_buf_lock);
 
        if (call_status != 0) {
@@ -419,7 +426,8 @@ static void parse_em_data(struct seq_file *m)
 {
        unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
 
-       if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+       if (firmware_has_feature(FW_FEATURE_LPAR) &&
+           plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
                seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
 }
 
@@ -678,7 +686,6 @@ static int lparcfg_open(struct inode *inode, struct file 
*file)
 }
 
 static const struct file_operations lparcfg_fops = {
-       .owner          = THIS_MODULE,
        .read           = seq_read,
        .write          = lparcfg_write,
        .open           = lparcfg_open,
@@ -704,15 +711,4 @@ static int __init lparcfg_init(void)
        proc_ppc64_lparcfg = ent;
        return 0;
 }
-
-static void __exit lparcfg_cleanup(void)
-{
-       if (proc_ppc64_lparcfg)
-               remove_proc_entry("lparcfg", proc_ppc64_lparcfg->parent);
-}
-
-module_init(lparcfg_init);
-module_exit(lparcfg_cleanup);
-MODULE_DESCRIPTION("Interface for LPAR configuration data");
-MODULE_AUTHOR("Dave Engebretsen");
-MODULE_LICENSE("GPL");
+machine_device_initcall(pseries, lparcfg_init);
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 389bd4f0cdb1..5c9eccc602ef 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -76,7 +76,7 @@
 #endif
 
 int boot_cpuid = 0;
-int __initdata spinning_secondaries;
+int spinning_secondaries;
 u64 ppc64_pft_size;
 
 /* Pick defaults since we might want to patch instructions
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 8302af649219..a191a72372fa 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -17,6 +17,7 @@
 #include <asm/machdep.h>
 #include <asm/smp.h>
 #include <asm/pmc.h>
+#include <asm/firmware.h>
 
 #include "cacheinfo.h"
 
@@ -179,15 +180,25 @@ SYSFS_PMCSETUP(spurr, SPRN_SPURR);
 SYSFS_PMCSETUP(dscr, SPRN_DSCR);
 SYSFS_PMCSETUP(pir, SPRN_PIR);
 
+/*
+  Lets only enable read for phyp resources and
+  enable write when needed with a separate function.
+  Lets be conservative and default to pseries.
+ */
 static DEVICE_ATTR(mmcra, 0600, show_mmcra, store_mmcra);
 static DEVICE_ATTR(spurr, 0600, show_spurr, NULL);
 static DEVICE_ATTR(dscr, 0600, show_dscr, store_dscr);
-static DEVICE_ATTR(purr, 0600, show_purr, store_purr);
+static DEVICE_ATTR(purr, 0400, show_purr, store_purr);
 static DEVICE_ATTR(pir, 0400, show_pir, NULL);
 
 unsigned long dscr_default = 0;
 EXPORT_SYMBOL(dscr_default);
 
+static void add_write_permission_dev_attr(struct device_attribute *attr)
+{
+       attr->attr.mode |= 0200;
+}
+
 static ssize_t show_dscr_default(struct device *dev,
                struct device_attribute *attr, char *buf)
 {
@@ -394,8 +405,11 @@ static void __cpuinit register_cpu_online(unsigned int cpu)
        if (cpu_has_feature(CPU_FTR_MMCRA))
                device_create_file(s, &dev_attr_mmcra);
 
-       if (cpu_has_feature(CPU_FTR_PURR))
+       if (cpu_has_feature(CPU_FTR_PURR)) {
+               if (!firmware_has_feature(FW_FEATURE_LPAR))
+                       add_write_permission_dev_attr(&dev_attr_purr);
                device_create_file(s, &dev_attr_purr);
+       }
 
        if (cpu_has_feature(CPU_FTR_SPURR))
                device_create_file(s, &dev_attr_spurr);
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index eb6b72faec0d..b32729b694c2 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -212,8 +212,6 @@ static u64 scan_dispatch_log(u64 stop_tb)
        if (i == vpa->dtl_idx)
                return 0;
        while (i < vpa->dtl_idx) {
-               if (dtl_consumer)
-                       dtl_consumer(dtl, i);
                dtb = dtl->timebase;
                tb_delta = dtl->enqueue_to_dispatch_time +
                        dtl->ready_to_enqueue_time;
@@ -226,6 +224,8 @@ static u64 scan_dispatch_log(u64 stop_tb)
                }
                if (dtb > stop_tb)
                        break;
+               if (dtl_consumer)
+                       dtl_consumer(dtl, i);
                stolen += tb_delta;
                ++i;
                ++dtl;
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 3bb7197a7bdc..5557044b78ab 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -1074,6 +1074,16 @@ void __kprobes program_check_exception(struct pt_regs 
*regs)
                _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
 }
 
+/*
+ * This occurs when running in hypervisor mode on POWER6 or later
+ * and an illegal instruction is encountered.
+ */
+void __kprobes emulation_assist_interrupt(struct pt_regs *regs)
+{
+       regs->msr |= REASON_ILLEGAL;
+       program_check_exception(regs);
+}
+
 void alignment_exception(struct pt_regs *regs)
 {
        int sig, code, fixed = 0;
diff --git a/arch/powerpc/lib/checksum_64.S b/arch/powerpc/lib/checksum_64.S
index afa2ebaee174..3cdbc648d979 100644
--- a/arch/powerpc/lib/checksum_64.S
+++ b/arch/powerpc/lib/checksum_64.S
@@ -229,19 +229,35 @@ _GLOBAL(csum_partial)
        blr
 
 
-       .macro source
+       .macro srcnr
 100:
        .section __ex_table,"a"
        .align 3
-       .llong 100b,.Lsrc_error
+       .llong 100b,.Lsrc_error_nr
        .previous
        .endm
 
-       .macro dest
+       .macro source
+150:
+       .section __ex_table,"a"
+       .align 3
+       .llong 150b,.Lsrc_error
+       .previous
+       .endm
+
+       .macro dstnr
 200:
        .section __ex_table,"a"
        .align 3
-       .llong 200b,.Ldest_error
+       .llong 200b,.Ldest_error_nr
+       .previous
+       .endm
+
+       .macro dest
+250:
+       .section __ex_table,"a"
+       .align 3
+       .llong 250b,.Ldest_error
        .previous
        .endm
 
@@ -277,11 +293,11 @@ _GLOBAL(csum_partial_copy_generic)
        mtctr   r6
 
 1:
-source;        lhz     r6,0(r3)                /* align to doubleword */
+srcnr; lhz     r6,0(r3)                /* align to doubleword */
        subi    r5,r5,2
        addi    r3,r3,2
        adde    r0,r0,r6
-dest;  sth     r6,0(r4)
+dstnr; sth     r6,0(r4)
        addi    r4,r4,2
        bdnz    1b
 
@@ -395,10 +411,10 @@ dest;     std     r16,56(r4)
 
        mtctr   r6
 3:
-source;        ld      r6,0(r3)
+srcnr; ld      r6,0(r3)
        addi    r3,r3,8
        adde    r0,r0,r6
-dest;  std     r6,0(r4)
+dstnr; std     r6,0(r4)
        addi    r4,r4,8
        bdnz    3b
 
@@ -408,10 +424,10 @@ dest;     std     r6,0(r4)
        srdi.   r6,r5,2
        beq     .Lcopy_tail_halfword
 
-source;        lwz     r6,0(r3)
+srcnr; lwz     r6,0(r3)
        addi    r3,r3,4
        adde    r0,r0,r6
-dest;  stw     r6,0(r4)
+dstnr; stw     r6,0(r4)
        addi    r4,r4,4
        subi    r5,r5,4
 
@@ -419,10 +435,10 @@ dest;     stw     r6,0(r4)
        srdi.   r6,r5,1
        beq     .Lcopy_tail_byte
 
-source;        lhz     r6,0(r3)
+srcnr; lhz     r6,0(r3)
        addi    r3,r3,2
        adde    r0,r0,r6
-dest;  sth     r6,0(r4)
+dstnr; sth     r6,0(r4)
        addi    r4,r4,2
        subi    r5,r5,2
 
@@ -430,10 +446,10 @@ dest;     sth     r6,0(r4)
        andi.   r6,r5,1
        beq     .Lcopy_finish
 
-source;        lbz     r6,0(r3)
+srcnr; lbz     r6,0(r3)
        sldi    r9,r6,8                 /* Pad the byte out to 16 bits */
        adde    r0,r0,r9
-dest;  stb     r6,0(r4)
+dstnr; stb     r6,0(r4)
 
 .Lcopy_finish:
        addze   r0,r0                   /* add in final carry */
@@ -443,6 +459,11 @@ dest;      stb     r6,0(r4)
        blr
 
 .Lsrc_error:
+       ld      r14,STK_REG(r14)(r1)
+       ld      r15,STK_REG(r15)(r1)
+       ld      r16,STK_REG(r16)(r1)
+       addi    r1,r1,STACKFRAMESIZE
+.Lsrc_error_nr:
        cmpdi   0,r7,0
        beqlr
        li      r6,-EFAULT
@@ -450,6 +471,11 @@ dest;      stb     r6,0(r4)
        blr
 
 .Ldest_error:
+       ld      r14,STK_REG(r14)(r1)
+       ld      r15,STK_REG(r15)(r1)
+       ld      r16,STK_REG(r16)(r1)
+       addi    r1,r1,STACKFRAMESIZE
+.Ldest_error_nr:
        cmpdi   0,r8,0
        beqlr
        li      r6,-EFAULT
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index d57eacb9fcf6..944471f4d142 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -102,7 +102,7 @@
 #define KVM_REFILL_PAGES 25
 #define KVM_MAX_CPUID_ENTRIES 80
 #define KVM_NR_FIXED_MTRR_REGION 88
-#define KVM_NR_VAR_MTRR 8
+#define KVM_NR_VAR_MTRR 10
 
 #define ASYNC_PF_PER_VCPU 64
 
@@ -436,7 +436,7 @@ struct kvm_vcpu_arch {
        bool nmi_injected;    /* Trying to inject an NMI this entry */
 
        struct mtrr_state_type mtrr_state;
-       u32 pat;
+       u64 pat;
 
        int switch_db_regs;
        unsigned long db[KVM_NR_DB_REGS];
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 415448af36bf..8c5ad89a65a5 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -463,6 +463,22 @@ static struct dmi_system_id video_dmi_table[] __initdata = 
{
                DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion m4 Notebook PC"),
                },
        },
+       {
+        .callback = video_ignore_initial_backlight,
+        .ident = "HP 1000 Notebook PC",
+        .matches = {
+               DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
+               DMI_MATCH(DMI_PRODUCT_NAME, "HP 1000 Notebook PC"),
+               },
+       },
+       {
+        .callback = video_ignore_initial_backlight,
+        .ident = "HP Pavilion dm4",
+        .matches = {
+               DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
+               DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dm4 Notebook PC"),
+               },
+       },
        {}
 };
 
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 45d8097ef4cf..144088717b86 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -132,6 +132,49 @@ find_video(acpi_handle handle, u32 lvl, void *context, 
void **rv)
        return AE_OK;
 }
 
+/* Force to use vendor driver when the ACPI device is known to be
+ * buggy */
+static int video_detect_force_vendor(const struct dmi_system_id *d)
+{
+       acpi_video_support |= ACPI_VIDEO_BACKLIGHT_DMI_VENDOR;
+       return 0;
+}
+
+static struct dmi_system_id video_detect_dmi_table[] = {
+       /* On Samsung X360, the BIOS will set a flag (VDRV) if generic
+        * ACPI backlight device is used. This flag will definitively break
+        * the backlight interface (even the vendor interface) untill next
+        * reboot. It's why we should prevent video.ko from being used here
+        * and we can't rely on a later call to acpi_video_unregister().
+        */
+       {
+        .callback = video_detect_force_vendor,
+        .ident = "X360",
+        .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+               DMI_MATCH(DMI_PRODUCT_NAME, "X360"),
+               DMI_MATCH(DMI_BOARD_NAME, "X360"),
+               },
+       },
+       {
+       .callback = video_detect_force_vendor,
+       .ident = "Asus UL30VT",
+       .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+               DMI_MATCH(DMI_PRODUCT_NAME, "UL30VT"),
+               },
+       },
+       {
+       .callback = video_detect_force_vendor,
+       .ident = "Asus UL30A",
+       .matches = {
+               DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+               DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"),
+               },
+       },
+       { },
+};
+
 /*
  * Returns the video capabilities of a specific ACPI graphics device
  *
@@ -164,6 +207,8 @@ long acpi_video_get_capabilities(acpi_handle 
graphics_handle)
                 *              ACPI_VIDEO_BACKLIGHT_DMI_VENDOR;
                 *}
                 */
+
+               dmi_check_system(video_detect_dmi_table);
        } else {
                status = acpi_bus_get_device(graphics_handle, &tmp_dev);
                if (ACPI_FAILURE(status)) {
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c 
b/drivers/gpu/drm/radeon/atombios_crtc.c
index dc612efbeb7a..d51c08da3f69 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -863,14 +863,16 @@ static void atombios_crtc_program_pll(struct drm_crtc 
*crtc,
                        args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */
                        if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
                                args.v5.ucMiscInfo |= 
PIXEL_CLOCK_V5_MISC_REF_DIV_SRC;
-                       switch (bpc) {
-                       case 8:
-                       default:
-                               args.v5.ucMiscInfo |= 
PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
-                               break;
-                       case 10:
-                               args.v5.ucMiscInfo |= 
PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
-                               break;
+                       if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
+                               switch (bpc) {
+                               case 8:
+                               default:
+                                       args.v5.ucMiscInfo |= 
PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
+                                       break;
+                               case 10:
+                                       args.v5.ucMiscInfo |= 
PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
+                                       break;
+                               }
                        }
                        args.v5.ucTransmitterID = encoder_id;
                        args.v5.ucEncoderMode = encoder_mode;
@@ -885,20 +887,22 @@ static void atombios_crtc_program_pll(struct drm_crtc 
*crtc,
                        args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */
                        if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
                                args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_REF_DIV_SRC;
-                       switch (bpc) {
-                       case 8:
-                       default:
-                               args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
-                               break;
-                       case 10:
-                               args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
-                               break;
-                       case 12:
-                               args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
-                               break;
-                       case 16:
-                               args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
-                               break;
+                       if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
+                               switch (bpc) {
+                               case 8:
+                               default:
+                                       args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
+                                       break;
+                               case 10:
+                                       args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
+                                       break;
+                               case 12:
+                                       args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
+                                       break;
+                               case 16:
+                                       args.v6.ucMiscInfo |= 
PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
+                                       break;
+                               }
                        }
                        args.v6.ucTransmitterID = encoder_id;
                        args.v6.ucEncoderMode = encoder_mode;
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c 
b/drivers/gpu/drm/radeon/atombios_encoders.c
index 072229dca464..dd5c14e917e0 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1666,8 +1666,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder 
*encoder)
                                        args.v2.ucEncodeMode = 
ATOM_ENCODER_MODE_CRT;
                                else
                                        args.v2.ucEncodeMode = 
atombios_get_encoder_mode(encoder);
-                       } else
+                       } else if (radeon_encoder->devices & 
(ATOM_DEVICE_LCD_SUPPORT)) {
+                               args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
+                       } else {
                                args.v2.ucEncodeMode = 
atombios_get_encoder_mode(encoder);
+                       }
                        switch (radeon_encoder->encoder_id) {
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c 
b/drivers/gpu/drm/radeon/radeon_connectors.c
index 1334dbd15c1b..9184bbe7c602 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1279,7 +1279,7 @@ bool radeon_connector_is_dp12_capable(struct 
drm_connector *connector)
        struct radeon_device *rdev = dev->dev_private;
 
        if (ASIC_IS_DCE5(rdev) &&
-           (rdev->clock.dp_extclk >= 53900) &&
+           (rdev->clock.default_dispclk >= 53900) &&
            radeon_connector_encoder_is_hbr2(connector)) {
                return true;
        }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 6651cb328598..7fc3dc7f9985 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, 
info->var.yoffset);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
-               vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, 
info->fix.line_length);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
        }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3a8ef589d8c0..17e2f526457c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7180,6 +7180,19 @@ void md_do_sync(struct mddev *mddev)
                            rdev->recovery_offset < j)
                                j = rdev->recovery_offset;
                rcu_read_unlock();
+
+               /* If there is a bitmap, we need to make sure all
+                * writes that started before we added a spare
+                * complete before we start doing a recovery.
+                * Otherwise the write might complete and (via
+                * bitmap_endwrite) set a bit in the bitmap after the
+                * recovery has checked that bit and skipped that
+                * region.
+                */
+               if (mddev->bitmap) {
+                       mddev->pers->quiesce(mddev, 1);
+                       mddev->pers->quiesce(mddev, 0);
+               }
        }
 
        printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index def50caa6f84..fd11af4a702a 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -93,10 +93,10 @@
 
 /* macros for registers read/write */
 #define nand_writel(info, off, val)    \
-       __raw_writel((val), (info)->mmio_base + (off))
+       writel_relaxed((val), (info)->mmio_base + (off))
 
 #define nand_readl(info, off)          \
-       __raw_readl((info)->mmio_base + (off))
+       readl_relaxed((info)->mmio_base + (off))
 
 /* error code and state */
 enum {
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 9db0f8e132e6..ad3961177c68 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -808,9 +808,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, 
const void *_rxhdr)
                break;
        case B43_PHYTYPE_G:
                status.band = IEEE80211_BAND_2GHZ;
-               /* chanid is the radio channel cookie value as used
-                * to tune the radio. */
-               status.freq = chanid + 2400;
+               /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
+                * has been modified to be compatible with N-PHY and others.
+                */
+               if (dev->fw.rev >= 508)
+                       status.freq = ieee80211_channel_to_frequency(chanid, 
status.band);
+               else
+                       status.freq = chanid + 2400;
                break;
        case B43_PHYTYPE_N:
        case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c 
b/drivers/net/wireless/rt2x00/rt2500pci.c
index aa10c48c0dfa..f8ea77c87b20 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1679,8 +1679,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev 
*rt2x00dev)
        /*
         * Detect if this device has an hardware controlled radio.
         */
-       if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
+       if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
                __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
+               /*
+                * On this device RFKILL initialized during probe does not work.
+                */
+               __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
+       }
 
        /*
         * Check if the BBP tuning should be enabled.
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h 
b/drivers/net/wireless/rt2x00/rt2x00.h
index c264dfa6e611..4be11e36e3ca 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -717,6 +717,7 @@ enum rt2x00_capability_flags {
        REQUIRE_SW_SEQNO,
        REQUIRE_HT_TX_DESC,
        REQUIRE_PS_AUTOWAKE,
+       REQUIRE_DELAYED_RFKILL,
 
        /*
         * Capabilities
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c 
b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 8f2c88e2c339..da65f8e97754 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1022,9 +1022,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev 
*rt2x00dev)
                return;
 
        /*
-        * Unregister extra components.
+        * Stop rfkill polling.
         */
-       rt2x00rfkill_unregister(rt2x00dev);
+       if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+               rt2x00rfkill_unregister(rt2x00dev);
 
        /*
         * Allow the HW to uninitialize.
@@ -1062,6 +1063,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev 
*rt2x00dev)
 
        set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
 
+       /*
+        * Start rfkill polling.
+        */
+       if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+               rt2x00rfkill_register(rt2x00dev);
+
        return 0;
 }
 
@@ -1207,7 +1214,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        rt2x00link_register(rt2x00dev);
        rt2x00leds_register(rt2x00dev);
        rt2x00debug_register(rt2x00dev);
-       rt2x00rfkill_register(rt2x00dev);
+
+       /*
+        * Start rfkill polling.
+        */
+       if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+               rt2x00rfkill_register(rt2x00dev);
 
        return 0;
 
@@ -1223,6 +1235,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
        clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
 
        /*
+        * Stop rfkill polling.
+        */
+       if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+               rt2x00rfkill_unregister(rt2x00dev);
+
+       /*
         * Disable radio.
         */
        rt2x00lib_disable_radio(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c 
b/drivers/net/wireless/rt2x00/rt2x00mac.c
index af247b06c842..e6daf129cc36 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -517,6 +517,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum 
set_key_cmd cmd,
        crypto.cipher = rt2x00crypto_key_to_cipher(key);
        if (crypto.cipher == CIPHER_NONE)
                return -EOPNOTSUPP;
+       if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
+               return -EOPNOTSUPP;
 
        crypto.cmd = cmd;
 
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 337e8b33d9aa..ac58ee344790 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -484,7 +484,8 @@ static void purge_requests(struct ibmvscsi_host_data 
*hostdata, int error_code)
                                       evt->hostdata->dev);
                        if (evt->cmnd_done)
                                evt->cmnd_done(evt->cmnd);
-               } else if (evt->done)
+               } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
+                          evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
                        evt->done(evt);
                free_event_struct(&evt->hostdata->pool, evt);
                spin_lock_irqsave(hostdata->host->host_lock, flags);
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c 
b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index d92fe4037e94..6b349e301869 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int 
target, int lun, int task
                if ((target == -1 || cp->target == target) &&
                    (lun    == -1 || cp->lun    == lun)    &&
                    (task   == -1 || cp->tag    == task)) {
+#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING
                        sym_set_cam_status(cp->cmd, DID_SOFT_ERROR);
+#else
+                       sym_set_cam_status(cp->cmd, DID_REQUEUE);
+#endif
                        sym_remque(&cp->link_ccbq);
                        sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq);
                }
diff --git a/drivers/staging/bcm/InterfaceInit.c 
b/drivers/staging/bcm/InterfaceInit.c
index 8e3c586a699c..e0f40ae358ed 100644
--- a/drivers/staging/bcm/InterfaceInit.c
+++ b/drivers/staging/bcm/InterfaceInit.c
@@ -4,10 +4,12 @@ static struct usb_device_id InterfaceUsbtable[] = {
        { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3) },
        { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3B) },
        { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3L) },
-       { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SM250) },
+       { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SYM) },
        { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_226) },
        { USB_DEVICE(BCM_USB_VENDOR_ID_FOXCONN, BCM_USB_PRODUCT_ID_1901) },
        { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_TU25) },
+       { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_226) },
+       { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_326) },
        { }
 };
 MODULE_DEVICE_TABLE(usb, InterfaceUsbtable);
diff --git a/drivers/staging/bcm/InterfaceInit.h 
b/drivers/staging/bcm/InterfaceInit.h
index 058315a64c05..6fa4f09a37c6 100644
--- a/drivers/staging/bcm/InterfaceInit.h
+++ b/drivers/staging/bcm/InterfaceInit.h
@@ -8,10 +8,11 @@
 #define BCM_USB_PRODUCT_ID_T3  0x0300
 #define BCM_USB_PRODUCT_ID_T3B         0x0210
 #define BCM_USB_PRODUCT_ID_T3L         0x0220
-#define BCM_USB_PRODUCT_ID_SM250       0xbccd
 #define BCM_USB_PRODUCT_ID_SYM  0x15E
 #define BCM_USB_PRODUCT_ID_1901 0xe017
-#define BCM_USB_PRODUCT_ID_226  0x0132
+#define BCM_USB_PRODUCT_ID_226 0x0132 /* not sure if this is valid */
+#define BCM_USB_PRODUCT_ID_ZTE_226 0x172
+#define BCM_USB_PRODUCT_ID_ZTE_326 0x173 /* ZTE AX326 */
 #define BCM_USB_PRODUCT_ID_ZTE_TU25 0x0007
 
 #define BCM_USB_MINOR_BASE             192
diff --git a/drivers/staging/comedi/comedi_fops.c 
b/drivers/staging/comedi/comedi_fops.c
index 50dc93e2a227..fff275753416 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1078,22 +1078,19 @@ static int do_cmd_ioctl(struct comedi_device *dev,
                DPRINTK("subdevice busy\n");
                return -EBUSY;
        }
-       s->busy = file;
 
        /* make sure channel/gain list isn't too long */
        if (user_cmd.chanlist_len > s->len_chanlist) {
                DPRINTK("channel/gain list too long %u > %d\n",
                        user_cmd.chanlist_len, s->len_chanlist);
-               ret = -EINVAL;
-               goto cleanup;
+               return -EINVAL;
        }
 
        /* make sure channel/gain list isn't too short */
        if (user_cmd.chanlist_len < 1) {
                DPRINTK("channel/gain list too short %u < 1\n",
                        user_cmd.chanlist_len);
-               ret = -EINVAL;
-               goto cleanup;
+               return -EINVAL;
        }
 
        async->cmd = user_cmd;
@@ -1103,8 +1100,7 @@ static int do_cmd_ioctl(struct comedi_device *dev,
            kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
        if (!async->cmd.chanlist) {
                DPRINTK("allocation failed\n");
-               ret = -ENOMEM;
-               goto cleanup;
+               return -ENOMEM;
        }
 
        if (copy_from_user(async->cmd.chanlist, user_cmd.chanlist,
@@ -1156,6 +1152,9 @@ static int do_cmd_ioctl(struct comedi_device *dev,
 
        comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
 
+       /* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
+        * comedi_read() or comedi_write() */
+       s->busy = file;
        ret = s->do_cmd(dev, s);
        if (ret == 0)
                return 0;
@@ -1658,6 +1657,7 @@ static ssize_t comedi_write(struct file *file, const char 
__user *buf,
 
                if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
                        if (count == 0) {
+                               mutex_lock(&dev->mutex);
                                if (comedi_get_subdevice_runflags(s) &
                                        SRF_ERROR) {
                                        retval = -EPIPE;
@@ -1665,6 +1665,7 @@ static ssize_t comedi_write(struct file *file, const char 
__user *buf,
                                        retval = 0;
                                }
                                do_become_nonbusy(dev, s);
+                               mutex_unlock(&dev->mutex);
                        }
                        break;
                }
@@ -1779,6 +1780,7 @@ static ssize_t comedi_read(struct file *file, char __user 
*buf, size_t nbytes,
 
                if (n == 0) {
                        if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
+                               mutex_lock(&dev->mutex);
                                do_become_nonbusy(dev, s);
                                if (comedi_get_subdevice_runflags(s) &
                                    SRF_ERROR) {
@@ -1786,6 +1788,7 @@ static ssize_t comedi_read(struct file *file, char __user 
*buf, size_t nbytes,
                                } else {
                                        retval = 0;
                                }
+                               mutex_unlock(&dev->mutex);
                                break;
                        }
                        if (file->f_flags & O_NONBLOCK) {
@@ -1823,9 +1826,11 @@ static ssize_t comedi_read(struct file *file, char 
__user *buf, size_t nbytes,
                buf += n;
                break;          /* makes device work like a pipe */
        }
-       if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING)) &&
-           async->buf_read_count - async->buf_write_count == 0) {
-               do_become_nonbusy(dev, s);
+       if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING))) {
+               mutex_lock(&dev->mutex);
+               if (async->buf_read_count - async->buf_write_count == 0)
+                       do_become_nonbusy(dev, s);
+               mutex_unlock(&dev->mutex);
        }
        set_current_state(TASK_RUNNING);
        remove_wait_queue(&async->wait_head, &wait);
diff --git a/drivers/staging/comedi/drivers/das08.c 
b/drivers/staging/comedi/drivers/das08.c
index d2dd75e2af7f..e16d1f38ca64 100644
--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -385,7 +385,7 @@ static const struct das08_board_struct das08_boards[] = {
         .ai = das08_ai_rinsn,
         .ai_nbits = 16,
         .ai_pg = das08_pg_none,
-        .ai_encoding = das08_encode12,
+        .ai_encoding = das08_encode16,
         .ao = das08jr_ao_winsn,
         .ao_nbits = 16,
         .di = das08jr_di_rbits,
diff --git a/drivers/staging/wlags49_h2/wl_priv.c 
b/drivers/staging/wlags49_h2/wl_priv.c
index f30e5ee4bca3..ff459b206756 100644
--- a/drivers/staging/wlags49_h2/wl_priv.c
+++ b/drivers/staging/wlags49_h2/wl_priv.c
@@ -570,6 +570,7 @@ int wvlan_uil_put_info( struct uilreq *urq, struct 
wl_private *lp )
        ltv_t                   *pLtv;
        bool_t                  ltvAllocated = FALSE;
        ENCSTRCT                sEncryption;
+       size_t                  len;
 
 #ifdef USE_WDS
        hcf_16                  hcfPort  = HCF_PORT_0;
@@ -686,7 +687,8 @@ int wvlan_uil_put_info( struct uilreq *urq, struct 
wl_private *lp )
                                        break;
                                case CFG_CNF_OWN_NAME:
                                        memset( lp->StationName, 0, sizeof( 
lp->StationName ));
-                                       memcpy( (void *)lp->StationName, (void 
*)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]);
+                                       len = min_t(size_t, pLtv->u.u16[0], 
sizeof(lp->StationName));
+                                       strlcpy(lp->StationName, 
&pLtv->u.u8[2], len);
                                        pLtv->u.u16[0] = CNV_INT_TO_LITTLE( 
pLtv->u.u16[0] );
                                        break;
                                case CFG_CNF_LOAD_BALANCING:
@@ -1800,6 +1802,7 @@ int wvlan_set_station_nickname(struct net_device *dev,
 {
         struct wl_private *lp = wl_priv(dev);
         unsigned long flags;
+       size_t len;
         int         ret = 0;
        
/*------------------------------------------------------------------------*/
 
@@ -1810,8 +1813,8 @@ int wvlan_set_station_nickname(struct net_device *dev,
         wl_lock(lp, &flags);
 
         memset( lp->StationName, 0, sizeof( lp->StationName ));
-
-        memcpy( lp->StationName, extra, wrqu->data.length);
+       len = min_t(size_t, wrqu->data.length, sizeof(lp->StationName));
+       strlcpy(lp->StationName, extra, len);
 
         /* Commit the adapter parameters */
         wl_apply( lp );
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index f52cb1ae45d9..32d1effe3d44 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1361,11 +1361,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct 
usb_composite_dev *cdev)
        ffs->ep0req->context = ffs;
 
        lang = ffs->stringtabs;
-       for (lang = ffs->stringtabs; *lang; ++lang) {
-               struct usb_string *str = (*lang)->strings;
-               int id = first_id;
-               for (; str->s; ++id, ++str)
-                       str->id = id;
+       if (lang) {
+               for (; *lang; ++lang) {
+                       struct usb_string *str = (*lang)->strings;
+                       int id = first_id;
+                       for (; str->s; ++id, ++str)
+                               str->id = id;
+               }
        }
 
        ffs->gadget = cdev->gadget;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 87ee28e1e65e..6f1b36d15419 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3588,7 +3588,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd 
*xhci,
                return 0;
 
        max_burst = urb->ep->ss_ep_comp.bMaxBurst;
-       return roundup(total_packet_count, max_burst + 1) - 1;
+       return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
 }
 
 /*
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7299a06af9db..424d9cf9d9a0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -963,7 +963,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
  */
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
-       u32                     command, temp = 0;
+       u32                     command, temp = 0, status;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        struct usb_hcd          *secondary_hcd;
        int                     retval = 0;
@@ -1087,8 +1087,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
  done:
        if (retval == 0) {
-               usb_hcd_resume_root_hub(hcd);
-               usb_hcd_resume_root_hub(xhci->shared_hcd);
+               /* Resume root hubs only when have pending events. */
+               status = readl(&xhci->op_regs->status);
+               if (status & STS_EINT) {
+                       usb_hcd_resume_root_hub(hcd);
+                       usb_hcd_resume_root_hub(xhci->shared_hcd);
+               }
        }
 
        /*
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index bb9f4111d1b8..ed1650fb910d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1593,14 +1593,17 @@ static void ftdi_set_max_packet_size(struct 
usb_serial_port *port)
        struct usb_device *udev = serial->dev;
 
        struct usb_interface *interface = serial->interface;
-       struct usb_endpoint_descriptor *ep_desc = 
&interface->cur_altsetting->endpoint[1].desc;
+       struct usb_endpoint_descriptor *ep_desc;
 
        unsigned num_endpoints;
-       int i;
+       unsigned i;
 
        num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
        dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
 
+       if (!num_endpoints)
+               return;
+
        /* NOTE: some customers have programmed FT232R/FT245R devices
         * with an endpoint size of 0 - not good.  In this case, we
         * want to override the endpoint descriptor setting and use a
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f7ccfbcdbf04..58fcaa5ae548 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -357,6 +357,9 @@ static void option_instat_callback(struct urb *urb);
 /* Zoom */
 #define ZOOM_PRODUCT_4597                      0x9607
 
+/* SpeedUp SU9800 usb 3g modem */
+#define SPEEDUP_PRODUCT_SU9800                 0x9800
+
 /* Haier products */
 #define HAIER_VENDOR_ID                                0x201e
 #define HAIER_PRODUCT_CE100                    0x2009
@@ -377,8 +380,12 @@ static void option_instat_callback(struct urb *urb);
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                     0x0b3c
 #define OLIVETTI_PRODUCT_OLICARD100            0xc000
+#define OLIVETTI_PRODUCT_OLICARD120            0xc001
+#define OLIVETTI_PRODUCT_OLICARD140            0xc002
 #define OLIVETTI_PRODUCT_OLICARD145            0xc003
+#define OLIVETTI_PRODUCT_OLICARD155            0xc004
 #define OLIVETTI_PRODUCT_OLICARD200            0xc005
+#define OLIVETTI_PRODUCT_OLICARD160            0xc00a
 #define OLIVETTI_PRODUCT_OLICARD500            0xc00b
 
 /* Celot products */
@@ -1597,6 +1604,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
          .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
        },
+       { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 
SPEEDUP_PRODUCT_SU9800, 0xff) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
        { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -1631,15 +1639,21 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 
enumerates with Siemens or Cinterion VID depending on FW revision */
        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
-
-       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+               .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+               .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
+               .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
+               .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
-               .driver_info = (kernel_ulong_t)&net_intf6_blacklist
-       },
+               .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
+               .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
-               .driver_info = (kernel_ulong_t)&net_intf4_blacklist
-       },
+               .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 
450 1xEVDO modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, 
SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung 
GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 6a8568c6466f..f2da2bd20188 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -290,7 +290,8 @@ int
 cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                 const struct nls_table *cp, int mapChars)
 {
-       int i, j, charlen;
+       int i, charlen;
+       int j = 0;
        char src_char;
        __le16 dst_char;
        wchar_t tmp;
@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, 
int srclen,
        if (!mapChars)
                return cifs_strtoUTF16(target, source, PATH_MAX, cp);
 
-       for (i = 0, j = 0; i < srclen; j++) {
+       for (i = 0; i < srclen; j++) {
                src_char = source[i];
                charlen = 1;
                switch (src_char) {
                case 0:
-                       put_unaligned(0, &target[j]);
                        goto ctoUTF16_out;
                case ':':
                        dst_char = cpu_to_le16(UNI_COLON);
@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int 
srclen,
        }
 
 ctoUTF16_out:
+       put_unaligned(0, &target[j]); /* Null terminate target unicode string */
        return j;
 }
 
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 97a142cde23b..22beaff3544a 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -543,15 +543,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct 
nfsd4_compound_state *cstate,
 
        switch (create->cr_type) {
        case NF4LNK:
-               /* ugh! we have to null-terminate the linktext, or
-                * vfs_symlink() will choke.  it is always safe to
-                * null-terminate by brute force, since at worst we
-                * will overwrite the first byte of the create namelen
-                * in the XDR buffer, which has already been extracted
-                * during XDR decode.
-                */
-               create->cr_linkname[create->cr_linklen] = 0;
-
                status = nfsd_symlink(rqstp, &cstate->current_fh,
                                      create->cr_name, create->cr_namelen,
                                      create->cr_linkname, create->cr_linklen,
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index ba7bf4a11855..04a1ce42e32b 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -465,7 +465,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, 
struct nfsd4_create *create
                READ_BUF(4);
                READ32(create->cr_linklen);
                READ_BUF(create->cr_linklen);
-               SAVEMEM(create->cr_linkname, create->cr_linklen);
+               /*
+                * The VFS will want a null-terminated string, and
+                * null-terminating in place isn't safe since this might
+                * end on a page boundary:
+                */
+               create->cr_linkname =
+                               kmalloc(create->cr_linklen + 1, GFP_KERNEL);
+               if (!create->cr_linkname)
+                       return nfserr_jukebox;
+               memcpy(create->cr_linkname, p, create->cr_linklen);
+               create->cr_linkname[create->cr_linklen] = '\0';
+               defer_free(argp, kfree, create->cr_linkname);
                break;
        case NF4BLK:
        case NF4CHR:
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4e8e6685f513..473907ac9104 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -715,6 +715,22 @@ static inline int usb_make_path(struct usb_device *dev, 
char *buf, size_t size)
        .bcdDevice_hi = (hi)
 
 /**
+ * USB_DEVICE_INTERFACE_CLASS - describe a usb device with a specific 
interface class
+ * @vend: the 16 bit USB Vendor ID
+ * @prod: the 16 bit USB Product ID
+ * @cl: bInterfaceClass value
+ *
+ * This macro is used to create a struct usb_device_id that matches a
+ * specific interface class of devices.
+ */
+#define USB_DEVICE_INTERFACE_CLASS(vend, prod, cl) \
+       .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                      USB_DEVICE_ID_MATCH_INT_CLASS, \
+       .idVendor = (vend), \
+       .idProduct = (prod), \
+       .bInterfaceClass = (cl)
+
+/**
  * USB_DEVICE_INTERFACE_PROTOCOL - describe a usb device with a specific 
interface protocol
  * @vend: the 16 bit USB Vendor ID
  * @prod: the 16 bit USB Product ID
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 4886c1144972..7d6cb0b2d061 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1068,7 +1068,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, 
u16 max,
                                        u16 latency, u16 to_multiplier);
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
                                                        __u8 ltk[16]);
-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
 void hci_le_ltk_neg_reply(struct hci_conn *conn);
 
 int hci_do_inquiry(struct hci_dev *hdev, u8 length);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index d5facc8d78a4..0d4e0ad97a04 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2276,6 +2276,31 @@ static void set_huge_ptep_writable(struct vm_area_struct 
*vma,
                update_mmu_cache(vma, address, ptep);
 }
 
+static int is_hugetlb_entry_migration(pte_t pte)
+{
+       swp_entry_t swp;
+
+       if (huge_pte_none(pte) || pte_present(pte))
+               return 0;
+       swp = pte_to_swp_entry(pte);
+       if (non_swap_entry(swp) && is_migration_entry(swp))
+               return 1;
+       else
+               return 0;
+}
+
+static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+{
+       swp_entry_t swp;
+
+       if (huge_pte_none(pte) || pte_present(pte))
+               return 0;
+       swp = pte_to_swp_entry(pte);
+       if (non_swap_entry(swp) && is_hwpoison_entry(swp))
+               return 1;
+       else
+               return 0;
+}
 
 int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
                            struct vm_area_struct *vma)
@@ -2303,10 +2328,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, 
struct mm_struct *src,
 
                spin_lock(&dst->page_table_lock);
                spin_lock_nested(&src->page_table_lock, SINGLE_DEPTH_NESTING);
-               if (!huge_pte_none(huge_ptep_get(src_pte))) {
+               entry = huge_ptep_get(src_pte);
+               if (huge_pte_none(entry)) { /* skip none entry */
+                       ;
+               } else if (unlikely(is_hugetlb_entry_migration(entry) ||
+                                   is_hugetlb_entry_hwpoisoned(entry))) {
+                       swp_entry_t swp_entry = pte_to_swp_entry(entry);
+
+                       if (is_write_migration_entry(swp_entry) && cow) {
+                               /*
+                                * COW mappings require pages in both
+                                * parent and child to be set to read.
+                                */
+                               make_migration_entry_read(&swp_entry);
+                               entry = swp_entry_to_pte(swp_entry);
+                               set_huge_pte_at(src, addr, src_pte, entry);
+                       }
+                       set_huge_pte_at(dst, addr, dst_pte, entry);
+               } else {
                        if (cow)
                                huge_ptep_set_wrprotect(src, addr, src_pte);
-                       entry = huge_ptep_get(src_pte);
                        ptepage = pte_page(entry);
                        get_page(ptepage);
                        page_dup_rmap(ptepage);
@@ -2321,32 +2362,6 @@ nomem:
        return -ENOMEM;
 }
 
-static int is_hugetlb_entry_migration(pte_t pte)
-{
-       swp_entry_t swp;
-
-       if (huge_pte_none(pte) || pte_present(pte))
-               return 0;
-       swp = pte_to_swp_entry(pte);
-       if (non_swap_entry(swp) && is_migration_entry(swp))
-               return 1;
-       else
-               return 0;
-}
-
-static int is_hugetlb_entry_hwpoisoned(pte_t pte)
-{
-       swp_entry_t swp;
-
-       if (huge_pte_none(pte) || pte_present(pte))
-               return 0;
-       swp = pte_to_swp_entry(pte);
-       if (non_swap_entry(swp) && is_hwpoison_entry(swp))
-               return 1;
-       else
-               return 0;
-}
-
 void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
                            unsigned long end, struct page *ref_page)
 {
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 82f1b027ba1c..ee50c256fdc3 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -566,24 +566,24 @@ static inline int check_pgd_range(struct vm_area_struct 
*vma,
  * If pagelist != NULL then isolate pages from the LRU and
  * put them on the pagelist.
  */
-static struct vm_area_struct *
+static int
 check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
                const nodemask_t *nodes, unsigned long flags, void *private)
 {
-       int err;
-       struct vm_area_struct *first, *vma, *prev;
+       int err = 0;
+       struct vm_area_struct *vma, *prev;
 
 
-       first = find_vma(mm, start);
-       if (!first)
-               return ERR_PTR(-EFAULT);
+       vma = find_vma(mm, start);
+       if (!vma)
+               return -EFAULT;
        prev = NULL;
-       for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
+       for (; vma && vma->vm_start < end; vma = vma->vm_next) {
                if (!(flags & MPOL_MF_DISCONTIG_OK)) {
                        if (!vma->vm_next && vma->vm_end < end)
-                               return ERR_PTR(-EFAULT);
+                               return -EFAULT;
                        if (prev && prev->vm_end < vma->vm_start)
-                               return ERR_PTR(-EFAULT);
+                               return -EFAULT;
                }
                if (!is_vm_hugetlb_page(vma) &&
                    ((flags & MPOL_MF_STRICT) ||
@@ -597,14 +597,12 @@ check_range(struct mm_struct *mm, unsigned long start, 
unsigned long end,
                                start = vma->vm_start;
                        err = check_pgd_range(vma, start, endvma, nodes,
                                                flags, private);
-                       if (err) {
-                               first = ERR_PTR(err);
+                       if (err)
                                break;
-                       }
                }
                prev = vma;
        }
-       return first;
+       return err;
 }
 
 /*
@@ -945,16 +943,15 @@ static int migrate_to_node(struct mm_struct *mm, int 
source, int dest,
 {
        nodemask_t nmask;
        LIST_HEAD(pagelist);
-       int err = 0;
-       struct vm_area_struct *vma;
+       int err;
 
        nodes_clear(nmask);
        node_set(source, nmask);
 
-       vma = check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask,
+       err = check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask,
                        flags | MPOL_MF_DISCONTIG_OK, &pagelist);
-       if (IS_ERR(vma))
-               return PTR_ERR(vma);
+       if (err)
+               return err;
 
        if (!list_empty(&pagelist)) {
                err = migrate_pages(&pagelist, new_node_page, dest,
@@ -1058,16 +1055,17 @@ out:
 
 /*
  * Allocate a new page for page migration based on vma policy.
- * Start assuming that page is mapped by vma pointed to by @private.
+ * Start by assuming the page is mapped by the same vma as contains @start.
  * Search forward from there, if not.  N.B., this assumes that the
  * list of pages handed to migrate_pages()--which is how we get here--
  * is in virtual address order.
  */
-static struct page *new_vma_page(struct page *page, unsigned long private, int 
**x)
+static struct page *new_page(struct page *page, unsigned long start, int **x)
 {
-       struct vm_area_struct *vma = (struct vm_area_struct *)private;
+       struct vm_area_struct *vma;
        unsigned long uninitialized_var(address);
 
+       vma = find_vma(current->mm, start);
        while (vma) {
                address = page_address_in_vma(page, vma);
                if (address != -EFAULT)
@@ -1093,7 +1091,7 @@ int do_migrate_pages(struct mm_struct *mm,
        return -ENOSYS;
 }
 
-static struct page *new_vma_page(struct page *page, unsigned long private, int 
**x)
+static struct page *new_page(struct page *page, unsigned long start, int **x)
 {
        return NULL;
 }
@@ -1103,7 +1101,6 @@ static long do_mbind(unsigned long start, unsigned long 
len,
                     unsigned short mode, unsigned short mode_flags,
                     nodemask_t *nmask, unsigned long flags)
 {
-       struct vm_area_struct *vma;
        struct mm_struct *mm = current->mm;
        struct mempolicy *new;
        unsigned long end;
@@ -1167,19 +1164,17 @@ static long do_mbind(unsigned long start, unsigned long 
len,
        if (err)
                goto mpol_out;
 
-       vma = check_range(mm, start, end, nmask,
+       err = check_range(mm, start, end, nmask,
                          flags | MPOL_MF_INVERT, &pagelist);
 
-       err = PTR_ERR(vma);
-       if (!IS_ERR(vma)) {
+       if (!err) {
                int nr_failed = 0;
 
                err = mbind_range(mm, start, end, new);
 
                if (!list_empty(&pagelist)) {
-                       nr_failed = migrate_pages(&pagelist, new_vma_page,
-                                               (unsigned long)vma,
-                                               false, true);
+                       nr_failed = migrate_pages(&pagelist, new_page,
+                                                 start, false, true);
                        if (nr_failed)
                                putback_lru_pages(&pagelist);
                }
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 39b2baf6c1d5..70bdb7d1d6df 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -224,22 +224,6 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, 
__u8 rand[8],
 }
 EXPORT_SYMBOL(hci_le_start_enc);
 
-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
-{
-       struct hci_dev *hdev = conn->hdev;
-       struct hci_cp_le_ltk_reply cp;
-
-       BT_DBG("%p", conn);
-
-       memset(&cp, 0, sizeof(cp));
-
-       cp.handle = cpu_to_le16(conn->handle);
-       memcpy(cp.ltk, ltk, sizeof(ltk));
-
-       hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
-}
-EXPORT_SYMBOL(hci_le_ltk_reply);
-
 void hci_le_ltk_neg_reply(struct hci_conn *conn)
 {
        struct hci_dev *hdev = conn->hdev;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 21b2de18c3b7..04bff67d5efc 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3156,8 +3156,11 @@ static inline void hci_user_confirm_request_evt(struct 
hci_dev *hdev,
 
                /* If we're not the initiators request authorization to
                 * proceed from user space (mgmt_user_confirm with
-                * confirm_hint set to 1). */
-               if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
+                * confirm_hint set to 1). The exception is if neither
+                * side had MITM in which case we do auto-accept.
+                */
+               if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
+                   (loc_mitm || rem_mitm)) {
                        BT_DBG("Confirming auto-accept as acceptor");
                        confirm_hint = 1;
                        goto confirm;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 30f99c344847..d5404cc0248d 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -33,8 +33,7 @@ static ssize_t ieee80211_if_read(
        ssize_t ret = -EINVAL;
 
        read_lock(&dev_base_lock);
-       if (sdata->dev->reg_state == NETREG_REGISTERED)
-               ret = (*format)(sdata, buf, sizeof(buf));
+       ret = (*format)(sdata, buf, sizeof(buf));
        read_unlock(&dev_base_lock);
 
        if (ret >= 0)
@@ -61,8 +60,7 @@ static ssize_t ieee80211_if_write(
 
        ret = -ENODEV;
        rtnl_lock();
-       if (sdata->dev->reg_state == NETREG_REGISTERED)
-               ret = (*write)(sdata, buf, count);
+       ret = (*write)(sdata, buf, count);
        rtnl_unlock();
 
        return ret;
diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
index 8674b9ec14f6..b3dbf8e1ff05 100644
--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
@@ -116,8 +116,8 @@ static const struct {
        .header = {
                .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC),
                .length = cpu_to_le32(sizeof descriptors),
-               .fs_count = 3,
-               .hs_count = 3,
+               .fs_count = cpu_to_le32(3),
+               .hs_count = cpu_to_le32(3),
        },
        .fs_descs = {
                .intf = {
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to