diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/arm/boot/dts/imx27.dtsi linux-libre-3.12.44-gnu/arch/arm/boot/dts/imx27.dtsi
--- linux-libre-3.12.43-gnu/arch/arm/boot/dts/imx27.dtsi	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/arm/boot/dts/imx27.dtsi	2015-06-10 09:27:29.000000000 -0400
@@ -427,7 +427,7 @@
 
 			fec: ethernet@1002b000 {
 				compatible = "fsl,imx27-fec";
-				reg = <0x1002b000 0x4000>;
+				reg = <0x1002b000 0x1000>;
 				interrupts = <50>;
 				clocks = <&clks 48>, <&clks 67>;
 				clock-names = "ipg", "ahb";
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/arm/kernel/entry-common.S linux-libre-3.12.44-gnu/arch/arm/kernel/entry-common.S
--- linux-libre-3.12.43-gnu/arch/arm/kernel/entry-common.S	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/arm/kernel/entry-common.S	2015-06-10 09:27:29.000000000 -0400
@@ -32,7 +32,9 @@ ret_fast_syscall:
  UNWIND(.fnstart	)
  UNWIND(.cantunwind	)
 	disable_irq				@ disable interrupts
-	ldr	r1, [tsk, #TI_FLAGS]
+	ldr	r1, [tsk, #TI_FLAGS]		@ re-check for syscall tracing
+	tst	r1, #_TIF_SYSCALL_WORK
+	bne	__sys_trace_return
 	tst	r1, #_TIF_WORK_MASK
 	bne	fast_work_pending
 	asm_trace_hardirqs_on
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/m68k/mac/oss.c linux-libre-3.12.44-gnu/arch/m68k/mac/oss.c
--- linux-libre-3.12.43-gnu/arch/m68k/mac/oss.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/m68k/mac/oss.c	2015-06-10 09:27:29.000000000 -0400
@@ -48,9 +48,8 @@ void __init oss_init(void)
 	/* Disable all interrupts. Unlike a VIA it looks like we    */
 	/* do this by setting the source's interrupt level to zero. */
 
-	for (i = 0; i <= OSS_NUM_SOURCES; i++) {
+	for (i = 0; i < OSS_NUM_SOURCES; i++)
 		oss->irq_level[i] = 0;
-	}
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/mips/kvm/kvm_mips_emul.c linux-libre-3.12.44-gnu/arch/mips/kvm/kvm_mips_emul.c
--- linux-libre-3.12.43-gnu/arch/mips/kvm/kvm_mips_emul.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/mips/kvm/kvm_mips_emul.c	2015-06-10 09:27:29.000000000 -0400
@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_v
 		if (vcpu->mmio_needed == 2)
 			*gpr = *(int16_t *) run->mmio.data;
 		else
-			*gpr = *(int16_t *) run->mmio.data;
+			*gpr = *(uint16_t *)run->mmio.data;
 
 		break;
 	case 1:
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/powerpc/kernel/vmlinux.lds.S linux-libre-3.12.44-gnu/arch/powerpc/kernel/vmlinux.lds.S
--- linux-libre-3.12.43-gnu/arch/powerpc/kernel/vmlinux.lds.S	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/powerpc/kernel/vmlinux.lds.S	2015-06-10 09:27:29.000000000 -0400
@@ -213,6 +213,7 @@ SECTIONS
 		*(.opd)
 	}
 
+	. = ALIGN(256);
 	.got : AT(ADDR(.got) - LOAD_OFFSET) {
 		__toc_start = .;
 #ifndef CONFIG_RELOCATABLE
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/powerpc/mm/slice.c linux-libre-3.12.44-gnu/arch/powerpc/mm/slice.c
--- linux-libre-3.12.43-gnu/arch/powerpc/mm/slice.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/powerpc/mm/slice.c	2015-06-10 09:27:29.000000000 -0400
@@ -408,7 +408,7 @@ unsigned long slice_get_unmapped_area(un
 	if (fixed && (addr & ((1ul << pshift) - 1)))
 		return -EINVAL;
 	if (fixed && addr > (mm->task_size - len))
-		return -EINVAL;
+		return -ENOMEM;
 
 	/* If hint, make sure it matches our alignment restrictions */
 	if (!fixed && addr) {
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/s390/crypto/ghash_s390.c linux-libre-3.12.44-gnu/arch/s390/crypto/ghash_s390.c
--- linux-libre-3.12.43-gnu/arch/s390/crypto/ghash_s390.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/s390/crypto/ghash_s390.c	2015-06-10 09:27:29.000000000 -0400
@@ -16,11 +16,12 @@
 #define GHASH_DIGEST_SIZE	16
 
 struct ghash_ctx {
-	u8 icv[16];
-	u8 key[16];
+	u8 key[GHASH_BLOCK_SIZE];
 };
 
 struct ghash_desc_ctx {
+	u8 icv[GHASH_BLOCK_SIZE];
+	u8 key[GHASH_BLOCK_SIZE];
 	u8 buffer[GHASH_BLOCK_SIZE];
 	u32 bytes;
 };
@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
 static int ghash_init(struct shash_desc *desc)
 {
 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
 
 	memset(dctx, 0, sizeof(*dctx));
+	memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
 
 	return 0;
 }
@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_sh
 	}
 
 	memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
-	memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
 
 	return 0;
 }
@@ -54,7 +56,6 @@ static int ghash_update(struct shash_des
 			 const u8 *src, unsigned int srclen)
 {
 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
-	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
 	unsigned int n;
 	u8 *buf = dctx->buffer;
 	int ret;
@@ -70,7 +71,7 @@ static int ghash_update(struct shash_des
 		src += n;
 
 		if (!dctx->bytes) {
-			ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
+			ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
 					      GHASH_BLOCK_SIZE);
 			if (ret != GHASH_BLOCK_SIZE)
 				return -EIO;
@@ -79,7 +80,7 @@ static int ghash_update(struct shash_des
 
 	n = srclen & ~(GHASH_BLOCK_SIZE - 1);
 	if (n) {
-		ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
+		ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
 		if (ret != n)
 			return -EIO;
 		src += n;
@@ -94,7 +95,7 @@ static int ghash_update(struct shash_des
 	return 0;
 }
 
-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+static int ghash_flush(struct ghash_desc_ctx *dctx)
 {
 	u8 *buf = dctx->buffer;
 	int ret;
@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx
 
 		memset(pos, 0, dctx->bytes);
 
-		ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
+		ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
 		if (ret != GHASH_BLOCK_SIZE)
 			return -EIO;
+
+		dctx->bytes = 0;
 	}
 
-	dctx->bytes = 0;
 	return 0;
 }
 
 static int ghash_final(struct shash_desc *desc, u8 *dst)
 {
 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
-	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
 	int ret;
 
-	ret = ghash_flush(ctx, dctx);
+	ret = ghash_flush(dctx);
 	if (!ret)
-		memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
+		memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/include/asm/perf_event.h linux-libre-3.12.44-gnu/arch/x86/include/asm/perf_event.h
--- linux-libre-3.12.43-gnu/arch/x86/include/asm/perf_event.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/include/asm/perf_event.h	2015-06-10 09:27:29.000000000 -0400
@@ -169,6 +169,9 @@ struct x86_pmu_capability {
 #define IBS_CAPS_BRNTRGT		(1U<<5)
 #define IBS_CAPS_OPCNTEXT		(1U<<6)
 #define IBS_CAPS_RIPINVALIDCHK		(1U<<7)
+#define IBS_CAPS_OPBRNFUSE		(1U<<8)
+#define IBS_CAPS_FETCHCTLEXTD		(1U<<9)
+#define IBS_CAPS_OPDATA4		(1U<<10)
 
 #define IBS_CAPS_DEFAULT		(IBS_CAPS_AVAIL		\
 					 | IBS_CAPS_FETCHSAM	\
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/include/uapi/asm/msr-index.h linux-libre-3.12.44-gnu/arch/x86/include/uapi/asm/msr-index.h
--- linux-libre-3.12.43-gnu/arch/x86/include/uapi/asm/msr-index.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/include/uapi/asm/msr-index.h	2015-06-10 09:27:29.000000000 -0400
@@ -201,6 +201,7 @@
 #define MSR_AMD64_IBSOP_REG_MASK	((1UL<<MSR_AMD64_IBSOP_REG_COUNT)-1)
 #define MSR_AMD64_IBSCTL		0xc001103a
 #define MSR_AMD64_IBSBRTARGET		0xc001103b
+#define MSR_AMD64_IBSOPDATA4		0xc001103d
 #define MSR_AMD64_IBS_REG_COUNT_MAX	8 /* includes MSR_AMD64_IBSBRTARGET */
 
 /* Fam 16h MSRs */
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/Kconfig linux-libre-3.12.44-gnu/arch/x86/Kconfig
--- linux-libre-3.12.43-gnu/arch/x86/Kconfig	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/Kconfig	2015-06-10 09:27:29.000000000 -0400
@@ -156,7 +156,7 @@ config SBUS
 
 config NEED_DMA_MAP_STATE
 	def_bool y
-	depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG
+	depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
 
 config NEED_SG_DMA_LENGTH
 	def_bool y
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/kernel/amd_nb.c linux-libre-3.12.44-gnu/arch/x86/kernel/amd_nb.c
--- linux-libre-3.12.43-gnu/arch/x86/kernel/amd_nb.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/kernel/amd_nb.c	2015-06-10 09:27:29.000000000 -0400
@@ -22,6 +22,7 @@ const struct pci_device_id amd_nb_misc_i
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
 	{}
 };
 EXPORT_SYMBOL(amd_nb_misc_ids);
@@ -30,6 +31,7 @@ static const struct pci_device_id amd_nb
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
 	{}
 };
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/kernel/cpu/perf_event_amd_ibs.c linux-libre-3.12.44-gnu/arch/x86/kernel/cpu/perf_event_amd_ibs.c
--- linux-libre-3.12.43-gnu/arch/x86/kernel/cpu/perf_event_amd_ibs.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/kernel/cpu/perf_event_amd_ibs.c	2015-06-10 09:27:29.000000000 -0400
@@ -565,6 +565,21 @@ static int perf_ibs_handle_irq(struct pe
 				       perf_ibs->offset_max,
 				       offset + 1);
 	} while (offset < offset_max);
+	if (event->attr.sample_type & PERF_SAMPLE_RAW) {
+		/*
+		 * Read IbsBrTarget and IbsOpData4 separately
+		 * depending on their availability.
+		 * Can't add to offset_max as they are staggered
+		 */
+		if (ibs_caps & IBS_CAPS_BRNTRGT) {
+			rdmsrl(MSR_AMD64_IBSBRTARGET, *buf++);
+			size++;
+		}
+		if (ibs_caps & IBS_CAPS_OPDATA4) {
+			rdmsrl(MSR_AMD64_IBSOPDATA4, *buf++);
+			size++;
+		}
+	}
 	ibs_data.size = sizeof(u64) * size;
 
 	regs = *iregs;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/kvm/mmu.c linux-libre-3.12.44-gnu/arch/x86/kvm/mmu.c
--- linux-libre-3.12.43-gnu/arch/x86/kvm/mmu.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/kvm/mmu.c	2015-06-10 09:27:29.000000000 -0400
@@ -4123,7 +4123,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
 	++vcpu->kvm->stat.mmu_pte_write;
 	kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
 
-	mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
+	mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
 	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) {
 		if (detect_write_misaligned(sp, gpa, bytes) ||
 		      detect_write_flooding(sp)) {
diff -druNp --no-dereference linux-libre-3.12.43-gnu/arch/x86/net/bpf_jit_comp.c linux-libre-3.12.44-gnu/arch/x86/net/bpf_jit_comp.c
--- linux-libre-3.12.43-gnu/arch/x86/net/bpf_jit_comp.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/arch/x86/net/bpf_jit_comp.c	2015-06-10 09:27:29.000000000 -0400
@@ -211,7 +211,12 @@ void bpf_jit_compile(struct sk_filter *f
 	}
 	cleanup_addr = proglen; /* epilogue address */
 
-	for (pass = 0; pass < 10; pass++) {
+	/* JITed image shrinks with every pass and the loop iterates
+	 * until the image stops shrinking. Very large bpf programs
+	 * may converge on the last pass. In such case do one more
+	 * pass to emit the final image
+	 */
+	for (pass = 0; pass < 10 || image; pass++) {
 		u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
 		/* no prologue/epilogue for trivial filters (RET something) */
 		proglen = 0;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/crypto/ansi_cprng.c linux-libre-3.12.44-gnu/crypto/ansi_cprng.c
--- linux-libre-3.12.43-gnu/crypto/ansi_cprng.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/crypto/ansi_cprng.c	2015-06-10 09:27:29.000000000 -0400
@@ -210,7 +210,11 @@ static int get_prng_bytes(char *buf, siz
 		byte_count = DEFAULT_BLK_SZ;
 	}
 
-	err = byte_count;
+	/*
+	 * Return 0 in case of success as mandated by the kernel
+	 * crypto API interface definition.
+	 */
+	err = 0;
 
 	dbgprint(KERN_CRIT "getting %d random bytes for context %p\n",
 		byte_count, ctx);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/crypto/testmgr.c linux-libre-3.12.44-gnu/crypto/testmgr.c
--- linux-libre-3.12.43-gnu/crypto/testmgr.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/crypto/testmgr.c	2015-06-10 09:27:29.000000000 -0400
@@ -1460,11 +1460,11 @@ static int test_cprng(struct crypto_rng
 		for (j = 0; j < template[i].loops; j++) {
 			err = crypto_rng_get_bytes(tfm, result,
 						   template[i].rlen);
-			if (err != template[i].rlen) {
+			if (err < 0) {
 				printk(KERN_ERR "alg: cprng: Failed to obtain "
 				       "the correct amount of random data for "
-				       "%s (requested %d, got %d)\n", algo,
-				       template[i].rlen, err);
+				       "%s (requested %d)\n", algo,
+				       template[i].rlen);
 				goto out;
 			}
 		}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/Documentation/hwmon/k10temp linux-libre-3.12.44-gnu/Documentation/hwmon/k10temp
--- linux-libre-3.12.43-gnu/Documentation/hwmon/k10temp	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/Documentation/hwmon/k10temp	2015-06-10 09:27:29.000000000 -0400
@@ -11,8 +11,8 @@ Supported chips:
   Socket S1G2: Athlon (X2), Sempron (X2), Turion X2 (Ultra)
 * AMD Family 12h processors: "Llano" (E2/A4/A6/A8-Series)
 * AMD Family 14h processors: "Brazos" (C/E/G/Z-Series)
-* AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity"
-* AMD Family 16h processors: "Kabini"
+* AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity", "Kaveri", "Carrizo"
+* AMD Family 16h processors: "Kabini", "Mullins"
 
   Prefix: 'k10temp'
   Addresses scanned: PCI space
@@ -46,7 +46,7 @@ Description
 -----------
 
 This driver permits reading of the internal temperature sensor of AMD
-Family 10h/11h/12h/14h/15h processors.
+Family 10h/11h/12h/14h/15h/16h processors.
 
 All these processors have a sensor, but on those for Socket F or AM2+,
 the sensor may return inconsistent values (erratum 319).  The driver
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/acpi/osl.c linux-libre-3.12.44-gnu/drivers/acpi/osl.c
--- linux-libre-3.12.43-gnu/drivers/acpi/osl.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/acpi/osl.c	2015-06-10 09:27:29.000000000 -0400
@@ -177,7 +177,7 @@ static void __init acpi_request_region (
 		request_mem_region(addr, length, desc);
 }
 
-static int __init acpi_reserve_resources(void)
+static void __init acpi_reserve_resources(void)
 {
 	acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
 		"ACPI PM1a_EVT_BLK");
@@ -206,10 +206,7 @@ static int __init acpi_reserve_resources
 	if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
 		acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
 			       acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
-
-	return 0;
 }
-device_initcall(acpi_reserve_resources);
 
 void acpi_os_printf(const char *fmt, ...)
 {
@@ -1764,6 +1761,7 @@ acpi_status __init acpi_os_initialize(vo
 
 acpi_status __init acpi_os_initialize1(void)
 {
+	acpi_reserve_resources();
 	kacpid_wq = alloc_workqueue("kacpid", 0, 1);
 	kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
 	kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/ata/libahci.c linux-libre-3.12.44-gnu/drivers/ata/libahci.c
--- linux-libre-3.12.43-gnu/drivers/ata/libahci.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/ata/libahci.c	2015-06-10 09:27:29.000000000 -0400
@@ -1693,8 +1693,7 @@ static void ahci_handle_port_interrupt(s
 	if (unlikely(resetting))
 		status &= ~PORT_IRQ_BAD_PMP;
 
-	/* if LPM is enabled, PHYRDY doesn't mean anything */
-	if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
+	if (sata_lpm_ignore_phy_events(&ap->link)) {
 		status &= ~PORT_IRQ_PHYRDY;
 		ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
 	}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/ata/libata-core.c linux-libre-3.12.44-gnu/drivers/ata/libata-core.c
--- linux-libre-3.12.43-gnu/drivers/ata/libata-core.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/ata/libata-core.c	2015-06-10 09:27:29.000000000 -0400
@@ -4225,10 +4225,11 @@ static const struct ata_blacklist_entry
 
 	/* devices that don't properly handle queued TRIM commands */
 	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Crucial_CT???M500SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Micron_M550*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Crucial_CT*M550SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
-	{ "Samsung SSD 850 PRO*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Crucial_CT*M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Micron_M5[15]0*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Crucial_CT*M550*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Crucial_CT*MX100*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM, },
+	{ "Samsung SSD 8*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
 
 	/*
 	 * Some WD SATA-I drives spin up and down erratically when the link
@@ -6827,6 +6828,38 @@ u32 ata_wait_register(struct ata_port *a
 	return tmp;
 }
 
+/**
+ *	sata_lpm_ignore_phy_events - test if PHY event should be ignored
+ *	@link: Link receiving the event
+ *
+ *	Test whether the received PHY event has to be ignored or not.
+ *
+ *	LOCKING:
+ *	None:
+ *
+ *	RETURNS:
+ *	True if the event has to be ignored.
+ */
+bool sata_lpm_ignore_phy_events(struct ata_link *link)
+{
+	unsigned long lpm_timeout = link->last_lpm_change +
+				    msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
+
+	/* if LPM is enabled, PHYRDY doesn't mean anything */
+	if (link->lpm_policy > ATA_LPM_MAX_POWER)
+		return true;
+
+	/* ignore the first PHY event after the LPM policy changed
+	 * as it is might be spurious
+	 */
+	if ((link->flags & ATA_LFLAG_CHANGED) &&
+	    time_before(jiffies, lpm_timeout))
+		return true;
+
+	return false;
+}
+EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
+
 /*
  * Dummy port_ops
  */
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/ata/libata-eh.c linux-libre-3.12.44-gnu/drivers/ata/libata-eh.c
--- linux-libre-3.12.43-gnu/drivers/ata/libata-eh.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/ata/libata-eh.c	2015-06-10 09:27:29.000000000 -0400
@@ -3481,6 +3481,9 @@ static int ata_eh_set_lpm(struct ata_lin
 		}
 	}
 
+	link->last_lpm_change = jiffies;
+	link->flags |= ATA_LFLAG_CHANGED;
+
 	return 0;
 
 fail:
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/connector/connector.c linux-libre-3.12.44-gnu/drivers/connector/connector.c
--- linux-libre-3.12.43-gnu/drivers/connector/connector.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/connector/connector.c	2015-06-10 09:27:29.000000000 -0400
@@ -122,12 +122,18 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
  */
 static int cn_call_callback(struct sk_buff *skb)
 {
+	struct nlmsghdr *nlh;
 	struct cn_callback_entry *i, *cbq = NULL;
 	struct cn_dev *dev = &cdev;
 	struct cn_msg *msg = nlmsg_data(nlmsg_hdr(skb));
 	struct netlink_skb_parms *nsp = &NETLINK_CB(skb);
 	int err = -ENODEV;
 
+	/* verify msg->len is within skb */
+	nlh = nlmsg_hdr(skb);
+	if (nlh->nlmsg_len < NLMSG_HDRLEN + sizeof(struct cn_msg) + msg->len)
+		return -EINVAL;
+
 	spin_lock_bh(&dev->cbdev->queue_lock);
 	list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) {
 		if (cn_cb_equal(&i->id.id, &msg->id)) {
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/edac/amd64_edac.c linux-libre-3.12.44-gnu/drivers/edac/amd64_edac.c
--- linux-libre-3.12.43-gnu/drivers/edac/amd64_edac.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/edac/amd64_edac.c	2015-06-10 09:27:29.000000000 -0400
@@ -1806,6 +1806,17 @@ static struct amd64_family_type amd64_fa
 			.read_dct_pci_cfg	= f10_read_dct_pci_cfg,
 		}
 	},
+	[F16_M30H_CPUS] = {
+		.ctl_name = "F16h_M30h",
+		.f1_id = PCI_DEVICE_ID_AMD_16H_M30H_NB_F1,
+		.f3_id = PCI_DEVICE_ID_AMD_16H_M30H_NB_F3,
+		.ops = {
+			.early_channel_count	= f1x_early_channel_count,
+			.map_sysaddr_to_csrow	= f1x_map_sysaddr_to_csrow,
+			.dbam_to_cs		= f16_dbam_to_chip_select,
+			.read_dct_pci_cfg	= f10_read_dct_pci_cfg,
+		}
+	},
 };
 
 /*
@@ -2596,6 +2607,11 @@ static struct amd64_family_type *amd64_p
 		break;
 
 	case 0x16:
+		if (pvt->model == 0x30) {
+			fam_type = &amd64_family_types[F16_M30H_CPUS];
+			pvt->ops = &amd64_family_types[F16_M30H_CPUS].ops;
+			break;
+		}
 		fam_type		= &amd64_family_types[F16_CPUS];
 		pvt->ops		= &amd64_family_types[F16_CPUS].ops;
 		break;
@@ -2846,6 +2862,14 @@ static DEFINE_PCI_DEVICE_TABLE(amd64_pci
 		.subvendor	= PCI_ANY_ID,
 		.subdevice	= PCI_ANY_ID,
 		.class		= 0,
+		.class_mask	= 0,
+	},
+	{
+		.vendor		= PCI_VENDOR_ID_AMD,
+		.device		= PCI_DEVICE_ID_AMD_16H_M30H_NB_F2,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+		.class		= 0,
 		.class_mask	= 0,
 	},
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/edac/amd64_edac.h linux-libre-3.12.44-gnu/drivers/edac/amd64_edac.h
--- linux-libre-3.12.43-gnu/drivers/edac/amd64_edac.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/edac/amd64_edac.h	2015-06-10 09:27:29.000000000 -0400
@@ -176,6 +176,8 @@
 #define PCI_DEVICE_ID_AMD_15H_NB_F2	0x1602
 #define PCI_DEVICE_ID_AMD_16H_NB_F1	0x1531
 #define PCI_DEVICE_ID_AMD_16H_NB_F2	0x1532
+#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F1 0x1581
+#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F2 0x1582
 
 /*
  * Function 1 - Address Map
@@ -308,6 +310,7 @@ enum amd_families {
 	F15_CPUS,
 	F15_M30H_CPUS,
 	F16_CPUS,
+	F16_M30H_CPUS,
 	NUM_FAMILIES,
 };
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/edac/edac_mc_sysfs.c linux-libre-3.12.44-gnu/drivers/edac/edac_mc_sysfs.c
--- linux-libre-3.12.43-gnu/drivers/edac/edac_mc_sysfs.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/edac/edac_mc_sysfs.c	2015-06-10 09:27:29.000000000 -0400
@@ -911,7 +911,7 @@ int __init edac_debugfs_init(void)
 	return 0;
 }
 
-void __exit edac_debugfs_exit(void)
+void edac_debugfs_exit(void)
 {
 	debugfs_remove(edac_debugfs);
 }
@@ -1165,7 +1165,7 @@ int __init edac_mc_sysfs_init(void)
 	return err;
 }
 
-void __exit edac_mc_sysfs_exit(void)
+void edac_mc_sysfs_exit(void)
 {
 	device_unregister(mci_pdev);
 	edac_put_sysfs_subsys();
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/edac/edac_module.c linux-libre-3.12.44-gnu/drivers/edac/edac_module.c
--- linux-libre-3.12.43-gnu/drivers/edac/edac_module.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/edac/edac_module.c	2015-06-10 09:27:29.000000000 -0400
@@ -112,20 +112,23 @@ static int __init edac_init(void)
 
 	err = edac_mc_sysfs_init();
 	if (err)
-		goto error;
+		goto err_sysfs;
 
 	edac_debugfs_init();
 
-	/* Setup/Initialize the workq for this core */
 	err = edac_workqueue_setup();
 	if (err) {
-		edac_printk(KERN_ERR, EDAC_MC, "init WorkQueue failure\n");
-		goto error;
+		edac_printk(KERN_ERR, EDAC_MC, "Failure initializing workqueue\n");
+		goto err_wq;
 	}
 
 	return 0;
 
-error:
+err_wq:
+	edac_debugfs_exit();
+	edac_mc_sysfs_exit();
+
+err_sysfs:
 	return err;
 }
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/gpio/gpio-kempld.c linux-libre-3.12.44-gnu/drivers/gpio/gpio-kempld.c
--- linux-libre-3.12.43-gnu/drivers/gpio/gpio-kempld.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/gpio/gpio-kempld.c	2015-06-10 09:27:29.000000000 -0400
@@ -117,7 +117,7 @@ static int kempld_gpio_get_direction(str
 		= container_of(chip, struct kempld_gpio_data, chip);
 	struct kempld_device_data *pld = gpio->pld;
 
-	return kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset);
+	return !kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset);
 }
 
 static int kempld_gpio_pincount(struct kempld_device_data *pld)
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/gpio/gpiolib-of.c linux-libre-3.12.44-gnu/drivers/gpio/gpiolib-of.c
--- linux-libre-3.12.43-gnu/drivers/gpio/gpiolib-of.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/gpio/gpiolib-of.c	2015-06-10 09:27:29.000000000 -0400
@@ -49,7 +49,7 @@ static int of_gpiochip_find_and_xlate(st
 		 * Return false to keep looking, as more than one gpio chip
 		 * could be registered per of-node.
 		 */
-		gg_data->out_gpio = ERR_PTR(ret);
+		gg_data->out_gpio = ret;
 		return false;
 	 }
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/gpu/drm/radeon/cik.c linux-libre-3.12.44-gnu/drivers/gpu/drm/radeon/cik.c
--- linux-libre-3.12.43-gnu/drivers/gpu/drm/radeon/cik.c	2015-05-21 09:42:20.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/gpu/drm/radeon/cik.c	2015-06-16 04:14:03.000000000 -0400
@@ -4556,7 +4556,7 @@ static int cik_pcie_gart_enable(struct r
 	 */
 	/* set vm size, must be a multiple of 4 */
 	WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
-	WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
+	WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
 	for (i = 1; i < 16; i++) {
 		if (i < 8)
 			WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/gpu/drm/radeon/ni.c linux-libre-3.12.44-gnu/drivers/gpu/drm/radeon/ni.c
--- linux-libre-3.12.43-gnu/drivers/gpu/drm/radeon/ni.c	2015-05-21 09:42:05.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/gpu/drm/radeon/ni.c	2015-06-16 04:13:53.000000000 -0400
@@ -1240,7 +1240,8 @@ static int cayman_pcie_gart_enable(struc
 	 */
 	for (i = 1; i < 8; i++) {
 		WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
-		WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
+		WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2),
+			rdev->vm_manager.max_pfn - 1);
 		WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
 			rdev->gart.table_addr >> 12);
 	}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/gpu/drm/radeon/si.c linux-libre-3.12.44-gnu/drivers/gpu/drm/radeon/si.c
--- linux-libre-3.12.43-gnu/drivers/gpu/drm/radeon/si.c	2015-05-21 09:42:11.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/gpu/drm/radeon/si.c	2015-06-16 04:13:57.000000000 -0400
@@ -3942,7 +3942,7 @@ static int si_pcie_gart_enable(struct ra
 	/* empty context1-15 */
 	/* set vm size, must be a multiple of 4 */
 	WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
-	WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
+	WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
 	/* Assign the pt base to something valid for now; the pts used for
 	 * the VMs are determined by the application and setup and assigned
 	 * on the fly in the vm part of radeon_gart.c
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/hid/hid-debug.c linux-libre-3.12.44-gnu/drivers/hid/hid-debug.c
--- linux-libre-3.12.43-gnu/drivers/hid/hid-debug.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/hid/hid-debug.c	2015-06-10 09:27:29.000000000 -0400
@@ -1027,7 +1027,8 @@ static ssize_t hid_debug_events_read(str
 
 				if (!list->hdev || !list->hdev->debug) {
 					ret = -EIO;
-					break;
+					set_current_state(TASK_RUNNING);
+					goto out;
 				}
 
 				/* allow O_NONBLOCK from other threads */
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/hwmon/k10temp.c linux-libre-3.12.44-gnu/drivers/hwmon/k10temp.c
--- linux-libre-3.12.43-gnu/drivers/hwmon/k10temp.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/hwmon/k10temp.c	2015-06-10 09:27:29.000000000 -0400
@@ -33,6 +33,9 @@ static bool force;
 module_param(force, bool, 0444);
 MODULE_PARM_DESC(force, "force loading on processors with erratum 319");
 
+/* Provide lock for writing to NB_SMU_IND_ADDR */
+static DEFINE_MUTEX(nb_smu_ind_mutex);
+
 /* CPUID function 0x80000001, ebx */
 #define CPUID_PKGTYPE_MASK	0xf0000000
 #define CPUID_PKGTYPE_F		0x00000000
@@ -51,13 +54,38 @@ MODULE_PARM_DESC(force, "force loading o
 #define REG_NORTHBRIDGE_CAPABILITIES	0xe8
 #define  NB_CAP_HTC			0x00000400
 
+/*
+ * For F15h M60h, functionality of REG_REPORTED_TEMPERATURE
+ * has been moved to D0F0xBC_xD820_0CA4 [Reported Temperature
+ * Control]
+ */
+#define F15H_M60H_REPORTED_TEMP_CTRL_OFFSET	0xd8200ca4
+#define PCI_DEVICE_ID_AMD_15H_M60H_NB_F3	0x1573
+
+static void amd_nb_smu_index_read(struct pci_dev *pdev, unsigned int devfn,
+				  int offset, u32 *val)
+{
+	mutex_lock(&nb_smu_ind_mutex);
+	pci_bus_write_config_dword(pdev->bus, devfn,
+				   0xb8, offset);
+	pci_bus_read_config_dword(pdev->bus, devfn,
+				  0xbc, val);
+	mutex_unlock(&nb_smu_ind_mutex);
+}
+
 static ssize_t show_temp(struct device *dev,
 			 struct device_attribute *attr, char *buf)
 {
 	u32 regval;
+	struct pci_dev *pdev = to_pci_dev(dev);
 
-	pci_read_config_dword(to_pci_dev(dev),
-			      REG_REPORTED_TEMPERATURE, &regval);
+	if (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model == 0x60) {
+		amd_nb_smu_index_read(pdev, PCI_DEVFN(0, 0),
+				      F15H_M60H_REPORTED_TEMP_CTRL_OFFSET,
+				      &regval);
+	} else {
+		pci_read_config_dword(pdev, REG_REPORTED_TEMPERATURE, &regval);
+	}
 	return sprintf(buf, "%u\n", (regval >> 21) * 125);
 }
 
@@ -211,7 +239,9 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_i
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M60H_NB_F3) },
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
 	{}
 };
 MODULE_DEVICE_TABLE(pci, k10temp_id_table);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/hwmon/Kconfig linux-libre-3.12.44-gnu/drivers/hwmon/Kconfig
--- linux-libre-3.12.43-gnu/drivers/hwmon/Kconfig	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/hwmon/Kconfig	2015-06-10 09:27:29.000000000 -0400
@@ -296,8 +296,8 @@ config SENSORS_K10TEMP
 	  If you say yes here you get support for the temperature
 	  sensor(s) inside your CPU. Supported are later revisions of
 	  the AMD Family 10h and all revisions of the AMD Family 11h,
-	  12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity) and
-	  16h (Kabini) microarchitectures.
+	  12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity/Kaveri/Carrizo)
+	  and 16h (Kabini/Mullins) microarchitectures.
 
 	  This driver can also be built as a module.  If so, the module
 	  will be called k10temp.
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/hwmon/nct6775.c linux-libre-3.12.44-gnu/drivers/hwmon/nct6775.c
--- linux-libre-3.12.43-gnu/drivers/hwmon/nct6775.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/hwmon/nct6775.c	2015-06-10 09:27:29.000000000 -0400
@@ -978,6 +978,7 @@ nct6775_create_attr_group(struct device
 				 (*t)->dev_attr.attr.name, tg->base + i);
 			if ((*t)->s2) {
 				a2 = &su->u.a2;
+				sysfs_attr_init(&a2->dev_attr.attr);
 				a2->dev_attr.attr.name = su->name;
 				a2->nr = (*t)->u.s.nr + i;
 				a2->index = (*t)->u.s.index;
@@ -988,6 +989,7 @@ nct6775_create_attr_group(struct device
 				*attrs = &a2->dev_attr.attr;
 			} else {
 				a = &su->u.a1;
+				sysfs_attr_init(&a->dev_attr.attr);
 				a->dev_attr.attr.name = su->name;
 				a->index = (*t)->u.index + i;
 				a->dev_attr.attr.mode =
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/hwmon/ntc_thermistor.c linux-libre-3.12.44-gnu/drivers/hwmon/ntc_thermistor.c
--- linux-libre-3.12.43-gnu/drivers/hwmon/ntc_thermistor.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/hwmon/ntc_thermistor.c	2015-06-10 09:27:29.000000000 -0400
@@ -181,8 +181,10 @@ static struct ntc_thermistor_platform_da
 ntc_thermistor_parse_dt(struct platform_device *pdev)
 {
 	struct iio_channel *chan;
+	enum iio_chan_type type;
 	struct device_node *np = pdev->dev.of_node;
 	struct ntc_thermistor_platform_data *pdata;
+	int ret;
 
 	if (!np)
 		return NULL;
@@ -195,6 +197,13 @@ ntc_thermistor_parse_dt(struct platform_
 	if (IS_ERR(chan))
 		return ERR_CAST(chan);
 
+	ret = iio_get_channel_type(chan, &type);
+	if (ret < 0)
+		return ERR_PTR(ret);
+
+	if (type != IIO_VOLTAGE)
+		return ERR_PTR(-EINVAL);
+
 	if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv))
 		return ERR_PTR(-ENODEV);
 	if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm))
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/input/joystick/xpad.c linux-libre-3.12.44-gnu/drivers/input/joystick/xpad.c
--- linux-libre-3.12.43-gnu/drivers/input/joystick/xpad.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/input/joystick/xpad.c	2015-06-10 09:27:29.000000000 -0400
@@ -31,12 +31,14 @@
  *  - the iForce driver    drivers/char/joystick/iforce.c
  *  - the skeleton-driver  drivers/usb/usb-skeleton.c
  *  - Xbox 360 information http://www.free60.org/wiki/Gamepad
+ *  - Xbox One information https://github.com/quantus/xbox-one-controller-protocol
  *
  * Thanks to:
  *  - ITO Takayuki for providing essential xpad information on his website
  *  - Vojtech Pavlik     - iforce driver / input subsystem
  *  - Greg Kroah-Hartman - usb-skeleton driver
  *  - XBOX Linux project - extra USB id's
+ *  - Pekka Pöyry (quantus) - Xbox One controller reverse engineering
  *
  * TODO:
  *  - fine tune axes (especially trigger axes)
@@ -96,7 +98,8 @@
 #define XTYPE_XBOX        0
 #define XTYPE_XBOX360     1
 #define XTYPE_XBOX360W    2
-#define XTYPE_UNKNOWN     3
+#define XTYPE_XBOXONE     3
+#define XTYPE_UNKNOWN     4
 
 static bool dpad_to_buttons;
 module_param(dpad_to_buttons, bool, S_IRUGO);
@@ -122,6 +125,7 @@ static const struct xpad_device {
 	{ 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX },
 	{ 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", 0, XTYPE_XBOX },
 	{ 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 },
+	{ 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE },
 	{ 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
 	{ 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
 	{ 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
@@ -264,10 +268,12 @@ static const signed short xpad_abs_trigg
 	-1
 };
 
-/* Xbox 360 has a vendor-specific class, so we cannot match it with only
+/*
+ * Xbox 360 has a vendor-specific class, so we cannot match it with only
  * USB_INTERFACE_INFO (also specifically refused by USB subsystem), so we
  * match against vendor id as well. Wired Xbox 360 devices have protocol 1,
- * wireless controllers have protocol 129. */
+ * wireless controllers have protocol 129.
+ */
 #define XPAD_XBOX360_VENDOR_PROTOCOL(vend,pr) \
 	.match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
 	.idVendor = (vend), \
@@ -278,9 +284,21 @@ static const signed short xpad_abs_trigg
 	{ XPAD_XBOX360_VENDOR_PROTOCOL(vend,1) }, \
 	{ XPAD_XBOX360_VENDOR_PROTOCOL(vend,129) }
 
+/* The Xbox One controller uses subclass 71 and protocol 208. */
+#define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \
+	.match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
+	.idVendor = (vend), \
+	.bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
+	.bInterfaceSubClass = 71, \
+	.bInterfaceProtocol = (pr)
+#define XPAD_XBOXONE_VENDOR(vend) \
+	{ XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) }
+
 static struct usb_device_id xpad_table[] = {
 	{ USB_INTERFACE_INFO('X', 'B', 0) },	/* X-Box USB-IF not approved class */
+	XPAD_XBOX360_VENDOR(0x044f),		/* Thrustmaster X-Box 360 controllers */
 	XPAD_XBOX360_VENDOR(0x045e),		/* Microsoft X-Box 360 controllers */
+	XPAD_XBOXONE_VENDOR(0x045e),		/* Microsoft X-Box One controllers */
 	XPAD_XBOX360_VENDOR(0x046d),		/* Logitech X-Box 360 style controllers */
 	XPAD_XBOX360_VENDOR(0x0738),		/* Mad Catz X-Box 360 controllers */
 	{ USB_DEVICE(0x0738, 0x4540) },		/* Mad Catz Beat Pad */
@@ -314,12 +332,10 @@ struct usb_xpad {
 	struct urb *bulk_out;
 	unsigned char *bdata;
 
-#if defined(CONFIG_JOYSTICK_XPAD_FF) || defined(CONFIG_JOYSTICK_XPAD_LEDS)
 	struct urb *irq_out;		/* urb for interrupt out report */
 	unsigned char *odata;		/* output data */
 	dma_addr_t odata_dma;
 	struct mutex odata_mutex;
-#endif
 
 #if defined(CONFIG_JOYSTICK_XPAD_LEDS)
 	struct xpad_led *led;
@@ -506,6 +522,105 @@ static void xpad360w_process_packet(stru
 	xpad360_process_packet(xpad, cmd, &data[4]);
 }
 
+/*
+ *	xpadone_process_buttons
+ *
+ *	Process a button update packet from an Xbox one controller.
+ */
+static void xpadone_process_buttons(struct usb_xpad *xpad,
+				struct input_dev *dev,
+				unsigned char *data)
+{
+	/* menu/view buttons */
+	input_report_key(dev, BTN_START,  data[4] & 0x04);
+	input_report_key(dev, BTN_SELECT, data[4] & 0x08);
+
+	/* buttons A,B,X,Y */
+	input_report_key(dev, BTN_A,	data[4] & 0x10);
+	input_report_key(dev, BTN_B,	data[4] & 0x20);
+	input_report_key(dev, BTN_X,	data[4] & 0x40);
+	input_report_key(dev, BTN_Y,	data[4] & 0x80);
+
+	/* digital pad */
+	if (xpad->mapping & MAP_DPAD_TO_BUTTONS) {
+		/* dpad as buttons (left, right, up, down) */
+		input_report_key(dev, BTN_TRIGGER_HAPPY1, data[5] & 0x04);
+		input_report_key(dev, BTN_TRIGGER_HAPPY2, data[5] & 0x08);
+		input_report_key(dev, BTN_TRIGGER_HAPPY3, data[5] & 0x01);
+		input_report_key(dev, BTN_TRIGGER_HAPPY4, data[5] & 0x02);
+	} else {
+		input_report_abs(dev, ABS_HAT0X,
+				 !!(data[5] & 0x08) - !!(data[5] & 0x04));
+		input_report_abs(dev, ABS_HAT0Y,
+				 !!(data[5] & 0x02) - !!(data[5] & 0x01));
+	}
+
+	/* TL/TR */
+	input_report_key(dev, BTN_TL,	data[5] & 0x10);
+	input_report_key(dev, BTN_TR,	data[5] & 0x20);
+
+	/* stick press left/right */
+	input_report_key(dev, BTN_THUMBL, data[5] & 0x40);
+	input_report_key(dev, BTN_THUMBR, data[5] & 0x80);
+
+	if (!(xpad->mapping & MAP_STICKS_TO_NULL)) {
+		/* left stick */
+		input_report_abs(dev, ABS_X,
+				 (__s16) le16_to_cpup((__le16 *)(data + 10)));
+		input_report_abs(dev, ABS_Y,
+				 ~(__s16) le16_to_cpup((__le16 *)(data + 12)));
+
+		/* right stick */
+		input_report_abs(dev, ABS_RX,
+				 (__s16) le16_to_cpup((__le16 *)(data + 14)));
+		input_report_abs(dev, ABS_RY,
+				 ~(__s16) le16_to_cpup((__le16 *)(data + 16)));
+	}
+
+	/* triggers left/right */
+	if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) {
+		input_report_key(dev, BTN_TL2,
+				 (__u16) le16_to_cpup((__le16 *)(data + 6)));
+		input_report_key(dev, BTN_TR2,
+				 (__u16) le16_to_cpup((__le16 *)(data + 8)));
+	} else {
+		input_report_abs(dev, ABS_Z,
+				 (__u16) le16_to_cpup((__le16 *)(data + 6)));
+		input_report_abs(dev, ABS_RZ,
+				 (__u16) le16_to_cpup((__le16 *)(data + 8)));
+	}
+
+	input_sync(dev);
+}
+
+/*
+ *	xpadone_process_packet
+ *
+ *	Completes a request by converting the data into events for the
+ *	input subsystem. This version is for the Xbox One controller.
+ *
+ *	The report format was gleaned from
+ *	https://github.com/kylelemons/xbox/blob/master/xbox.go
+ */
+
+static void xpadone_process_packet(struct usb_xpad *xpad,
+				u16 cmd, unsigned char *data)
+{
+	struct input_dev *dev = xpad->dev;
+
+	switch (data[0]) {
+	case 0x20:
+		xpadone_process_buttons(xpad, dev, data);
+		break;
+
+	case 0x07:
+		/* the xbox button has its own special report */
+		input_report_key(dev, BTN_MODE, data[4] & 0x01);
+		input_sync(dev);
+		break;
+	}
+}
+
 static void xpad_irq_in(struct urb *urb)
 {
 	struct usb_xpad *xpad = urb->context;
@@ -538,6 +653,9 @@ static void xpad_irq_in(struct urb *urb)
 	case XTYPE_XBOX360W:
 		xpad360w_process_packet(xpad, 0, xpad->idata);
 		break;
+	case XTYPE_XBOXONE:
+		xpadone_process_packet(xpad, 0, xpad->idata);
+		break;
 	default:
 		xpad_process_packet(xpad, 0, xpad->idata);
 	}
@@ -571,7 +689,6 @@ static void xpad_bulk_out(struct urb *ur
 	}
 }
 
-#if defined(CONFIG_JOYSTICK_XPAD_FF) || defined(CONFIG_JOYSTICK_XPAD_LEDS)
 static void xpad_irq_out(struct urb *urb)
 {
 	struct usb_xpad *xpad = urb->context;
@@ -609,6 +726,7 @@ exit:
 static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad)
 {
 	struct usb_endpoint_descriptor *ep_irq_out;
+	int ep_irq_out_idx;
 	int error;
 
 	if (xpad->xtype == XTYPE_UNKNOWN)
@@ -629,7 +747,10 @@ static int xpad_init_output(struct usb_i
 		goto fail2;
 	}
 
-	ep_irq_out = &intf->cur_altsetting->endpoint[1].desc;
+	/* Xbox One controller has in/out endpoints swapped. */
+	ep_irq_out_idx = xpad->xtype == XTYPE_XBOXONE ? 0 : 1;
+	ep_irq_out = &intf->cur_altsetting->endpoint[ep_irq_out_idx].desc;
+
 	usb_fill_int_urb(xpad->irq_out, xpad->udev,
 			 usb_sndintpipe(xpad->udev, ep_irq_out->bEndpointAddress),
 			 xpad->odata, XPAD_PKT_LEN,
@@ -657,11 +778,6 @@ static void xpad_deinit_output(struct us
 				xpad->odata, xpad->odata_dma);
 	}
 }
-#else
-static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) { return 0; }
-static void xpad_deinit_output(struct usb_xpad *xpad) {}
-static void xpad_stop_output(struct usb_xpad *xpad) {}
-#endif
 
 #ifdef CONFIG_JOYSTICK_XPAD_FF
 static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
@@ -715,6 +831,23 @@ static int xpad_play_effect(struct input
 
 			return usb_submit_urb(xpad->irq_out, GFP_ATOMIC);
 
+		case XTYPE_XBOXONE:
+			xpad->odata[0] = 0x09; /* activate rumble */
+			xpad->odata[1] = 0x08;
+			xpad->odata[2] = 0x00;
+			xpad->odata[3] = 0x08; /* continuous effect */
+			xpad->odata[4] = 0x00; /* simple rumble mode */
+			xpad->odata[5] = 0x03; /* L and R actuator only */
+			xpad->odata[6] = 0x00; /* TODO: LT actuator */
+			xpad->odata[7] = 0x00; /* TODO: RT actuator */
+			xpad->odata[8] = strong / 256;	/* left actuator */
+			xpad->odata[9] = weak / 256;	/* right actuator */
+			xpad->odata[10] = 0x80;	/* length of pulse */
+			xpad->odata[11] = 0x00;	/* stop period of pulse */
+			xpad->irq_out->transfer_buffer_length = 12;
+
+			return usb_submit_urb(xpad->irq_out, GFP_ATOMIC);
+
 		default:
 			dev_dbg(&xpad->dev->dev,
 				"%s - rumble command sent to unsupported xpad type: %d\n",
@@ -837,6 +970,14 @@ static int xpad_open(struct input_dev *d
 	if (usb_submit_urb(xpad->irq_in, GFP_KERNEL))
 		return -EIO;
 
+	if (xpad->xtype == XTYPE_XBOXONE) {
+		/* Xbox one controller needs to be initialized. */
+		xpad->odata[0] = 0x05;
+		xpad->odata[1] = 0x20;
+		xpad->irq_out->transfer_buffer_length = 2;
+		return usb_submit_urb(xpad->irq_out, GFP_KERNEL);
+	}
+
 	return 0;
 }
 
@@ -852,6 +993,7 @@ static void xpad_close(struct input_dev
 
 static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
 {
+	struct usb_xpad *xpad = input_get_drvdata(input_dev);
 	set_bit(abs, input_dev->absbit);
 
 	switch (abs) {
@@ -863,7 +1005,10 @@ static void xpad_set_up_abs(struct input
 		break;
 	case ABS_Z:
 	case ABS_RZ:	/* the triggers (if mapped to axes) */
-		input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
+		if (xpad->xtype == XTYPE_XBOXONE)
+			input_set_abs_params(input_dev, abs, 0, 1023, 0, 0);
+		else
+			input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
 		break;
 	case ABS_HAT0X:
 	case ABS_HAT0Y:	/* the d-pad (only if dpad is mapped to axes */
@@ -878,6 +1023,7 @@ static int xpad_probe(struct usb_interfa
 	struct usb_xpad *xpad;
 	struct input_dev *input_dev;
 	struct usb_endpoint_descriptor *ep_irq_in;
+	int ep_irq_in_idx;
 	int i, error;
 
 	for (i = 0; xpad_device[i].idVendor; i++) {
@@ -886,6 +1032,16 @@ static int xpad_probe(struct usb_interfa
 			break;
 	}
 
+	if (xpad_device[i].xtype == XTYPE_XBOXONE &&
+	    intf->cur_altsetting->desc.bInterfaceNumber != 0) {
+		/*
+		 * The Xbox One controller lists three interfaces all with the
+		 * same interface class, subclass and protocol. Differentiate by
+		 * interface number.
+		 */
+		return -ENODEV;
+	}
+
 	xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL);
 	input_dev = input_allocate_device();
 	if (!xpad || !input_dev) {
@@ -956,7 +1112,8 @@ static int xpad_probe(struct usb_interfa
 		__set_bit(xpad_common_btn[i], input_dev->keybit);
 
 	/* set up model-specific ones */
-	if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W) {
+	if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W ||
+	    xpad->xtype == XTYPE_XBOXONE) {
 		for (i = 0; xpad360_btn[i] >= 0; i++)
 			__set_bit(xpad360_btn[i], input_dev->keybit);
 	} else {
@@ -969,7 +1126,7 @@ static int xpad_probe(struct usb_interfa
 			__set_bit(xpad_btn_pad[i], input_dev->keybit);
 	} else {
 		for (i = 0; xpad_abs_pad[i] >= 0; i++)
-		    xpad_set_up_abs(input_dev, xpad_abs_pad[i]);
+			xpad_set_up_abs(input_dev, xpad_abs_pad[i]);
 	}
 
 	if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) {
@@ -992,7 +1149,10 @@ static int xpad_probe(struct usb_interfa
 	if (error)
 		goto fail5;
 
-	ep_irq_in = &intf->cur_altsetting->endpoint[0].desc;
+	/* Xbox One controller has in/out endpoints swapped. */
+	ep_irq_in_idx = xpad->xtype == XTYPE_XBOXONE ? 1 : 0;
+	ep_irq_in = &intf->cur_altsetting->endpoint[ep_irq_in_idx].desc;
+
 	usb_fill_int_urb(xpad->irq_in, udev,
 			 usb_rcvintpipe(udev, ep_irq_in->bEndpointAddress),
 			 xpad->idata, XPAD_PKT_LEN, xpad_irq_in,
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/input/keyboard/cros_ec_keyb.c linux-libre-3.12.44-gnu/drivers/input/keyboard/cros_ec_keyb.c
--- linux-libre-3.12.43-gnu/drivers/input/keyboard/cros_ec_keyb.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/input/keyboard/cros_ec_keyb.c	2015-06-10 09:27:29.000000000 -0400
@@ -309,7 +309,7 @@ static int cros_ec_keyb_resume(struct de
 	 * wake source (e.g. the lid is open and the user might press a key to
 	 * wake) then the key scan buffer should be preserved.
 	 */
-	if (ckdev->ec->was_wake_device)
+	if (!ckdev->ec->was_wake_device)
 		cros_ec_keyb_clear_keyboard(ckdev);
 
 	return 0;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/input/mouse/elantech.c linux-libre-3.12.44-gnu/drivers/input/mouse/elantech.c
--- linux-libre-3.12.43-gnu/drivers/input/mouse/elantech.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/input/mouse/elantech.c	2015-06-10 09:27:29.000000000 -0400
@@ -314,7 +314,7 @@ static void elantech_report_semi_mt_data
 					 unsigned int x2, unsigned int y2)
 {
 	elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
-	elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
+	elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/input/touchscreen/usbtouchscreen.c linux-libre-3.12.44-gnu/drivers/input/touchscreen/usbtouchscreen.c
--- linux-libre-3.12.43-gnu/drivers/input/touchscreen/usbtouchscreen.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/input/touchscreen/usbtouchscreen.c	2015-06-10 09:27:29.000000000 -0400
@@ -133,6 +133,7 @@ enum {
 	DEVTYPE_GUNZE,
 	DEVTYPE_DMC_TSC10,
 	DEVTYPE_IRTOUCH,
+	DEVTYPE_IRTOUCH_HIRES,
 	DEVTYPE_IDEALTEK,
 	DEVTYPE_GENERAL_TOUCH,
 	DEVTYPE_GOTOP,
@@ -199,6 +200,7 @@ static const struct usb_device_id usbtou
 #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH
 	{USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
 	{USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+	{USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES},
 #endif
 
 #ifdef CONFIG_TOUCHSCREEN_USB_IDEALTEK
@@ -1178,6 +1180,15 @@ static struct usbtouch_device_info usbto
 		.rept_size	= 8,
 		.read_data	= irtouch_read_data,
 	},
+
+	[DEVTYPE_IRTOUCH_HIRES] = {
+		.min_xc		= 0x0,
+		.max_xc		= 0x7fff,
+		.min_yc		= 0x0,
+		.max_yc		= 0x7fff,
+		.rept_size	= 8,
+		.read_data	= irtouch_read_data,
+	},
 #endif
 
 #ifdef CONFIG_TOUCHSCREEN_USB_IDEALTEK
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/iommu/amd_iommu.c linux-libre-3.12.44-gnu/drivers/iommu/amd_iommu.c
--- linux-libre-3.12.43-gnu/drivers/iommu/amd_iommu.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/iommu/amd_iommu.c	2015-06-10 09:27:29.000000000 -0400
@@ -1376,7 +1376,9 @@ static u64 *alloc_pte(struct protection_
  * This function checks if there is a PTE for a given dma address. If
  * there is one, it returns the pointer to it.
  */
-static u64 *fetch_pte(struct protection_domain *domain, unsigned long address)
+static u64 *fetch_pte(struct protection_domain *domain,
+		      unsigned long address,
+		      unsigned long *page_size)
 {
 	int level;
 	u64 *pte;
@@ -1384,8 +1386,9 @@ static u64 *fetch_pte(struct protection_
 	if (address > PM_LEVEL_SIZE(domain->mode))
 		return NULL;
 
-	level   =  domain->mode - 1;
-	pte     = &domain->pt_root[PM_LEVEL_INDEX(level, address)];
+	level	   =  domain->mode - 1;
+	pte	   = &domain->pt_root[PM_LEVEL_INDEX(level, address)];
+	*page_size =  PTE_LEVEL_PAGE_SIZE(level);
 
 	while (level > 0) {
 
@@ -1394,19 +1397,9 @@ static u64 *fetch_pte(struct protection_
 			return NULL;
 
 		/* Large PTE */
-		if (PM_PTE_LEVEL(*pte) == 0x07) {
-			unsigned long pte_mask, __pte;
-
-			/*
-			 * If we have a series of large PTEs, make
-			 * sure to return a pointer to the first one.
-			 */
-			pte_mask = PTE_PAGE_SIZE(*pte);
-			pte_mask = ~((PAGE_SIZE_PTE_COUNT(pte_mask) << 3) - 1);
-			__pte    = ((unsigned long)pte) & pte_mask;
-
-			return (u64 *)__pte;
-		}
+		if (PM_PTE_LEVEL(*pte) == 7 ||
+		    PM_PTE_LEVEL(*pte) == 0)
+			break;
 
 		/* No level skipping support yet */
 		if (PM_PTE_LEVEL(*pte) != level)
@@ -1415,8 +1408,21 @@ static u64 *fetch_pte(struct protection_
 		level -= 1;
 
 		/* Walk to the next level */
-		pte = IOMMU_PTE_PAGE(*pte);
-		pte = &pte[PM_LEVEL_INDEX(level, address)];
+		pte	   = IOMMU_PTE_PAGE(*pte);
+		pte	   = &pte[PM_LEVEL_INDEX(level, address)];
+		*page_size = PTE_LEVEL_PAGE_SIZE(level);
+	}
+
+	if (PM_PTE_LEVEL(*pte) == 0x07) {
+		unsigned long pte_mask;
+
+		/*
+		 * If we have a series of large PTEs, make
+		 * sure to return a pointer to the first one.
+		 */
+		*page_size = pte_mask = PTE_PAGE_SIZE(*pte);
+		pte_mask   = ~((PAGE_SIZE_PTE_COUNT(pte_mask) << 3) - 1);
+		pte        = (u64 *)(((unsigned long)pte) & pte_mask);
 	}
 
 	return pte;
@@ -1438,19 +1444,20 @@ static int iommu_map_page(struct protect
 	u64 __pte, *pte;
 	int i, count;
 
+	BUG_ON(!IS_ALIGNED(bus_addr, page_size));
+	BUG_ON(!IS_ALIGNED(phys_addr, page_size));
+
 	if (!(prot & IOMMU_PROT_MASK))
 		return -EINVAL;
 
-	bus_addr  = PAGE_ALIGN(bus_addr);
-	phys_addr = PAGE_ALIGN(phys_addr);
-	count     = PAGE_SIZE_PTE_COUNT(page_size);
-	pte       = alloc_pte(dom, bus_addr, page_size, NULL, GFP_KERNEL);
+	count = PAGE_SIZE_PTE_COUNT(page_size);
+	pte   = alloc_pte(dom, bus_addr, page_size, NULL, GFP_KERNEL);
 
 	for (i = 0; i < count; ++i)
 		if (IOMMU_PTE_PRESENT(pte[i]))
 			return -EBUSY;
 
-	if (page_size > PAGE_SIZE) {
+	if (count > 1) {
 		__pte = PAGE_SIZE_PTE(phys_addr, page_size);
 		__pte |= PM_LEVEL_ENC(7) | IOMMU_PTE_P | IOMMU_PTE_FC;
 	} else
@@ -1473,7 +1480,8 @@ static unsigned long iommu_unmap_page(st
 				      unsigned long bus_addr,
 				      unsigned long page_size)
 {
-	unsigned long long unmap_size, unmapped;
+	unsigned long long unmapped;
+	unsigned long unmap_size;
 	u64 *pte;
 
 	BUG_ON(!is_power_of_2(page_size));
@@ -1482,28 +1490,12 @@ static unsigned long iommu_unmap_page(st
 
 	while (unmapped < page_size) {
 
-		pte = fetch_pte(dom, bus_addr);
-
-		if (!pte) {
-			/*
-			 * No PTE for this address
-			 * move forward in 4kb steps
-			 */
-			unmap_size = PAGE_SIZE;
-		} else if (PM_PTE_LEVEL(*pte) == 0) {
-			/* 4kb PTE found for this address */
-			unmap_size = PAGE_SIZE;
-			*pte       = 0ULL;
-		} else {
-			int count, i;
+		pte = fetch_pte(dom, bus_addr, &unmap_size);
 
-			/* Large PTE found which maps this address */
-			unmap_size = PTE_PAGE_SIZE(*pte);
+		if (pte) {
+			int i, count;
 
-			/* Only unmap from the first pte in the page */
-			if ((unmap_size - 1) & bus_addr)
-				break;
-			count      = PAGE_SIZE_PTE_COUNT(unmap_size);
+			count = PAGE_SIZE_PTE_COUNT(unmap_size);
 			for (i = 0; i < count; i++)
 				pte[i] = 0ULL;
 		}
@@ -1651,7 +1643,7 @@ static int alloc_new_range(struct dma_op
 {
 	int index = dma_dom->aperture_size >> APERTURE_RANGE_SHIFT;
 	struct amd_iommu *iommu;
-	unsigned long i, old_size;
+	unsigned long i, old_size, pte_pgsize;
 
 #ifdef CONFIG_IOMMU_STRESS
 	populate = false;
@@ -1724,12 +1716,13 @@ static int alloc_new_range(struct dma_op
 	 */
 	for (i = dma_dom->aperture[index]->offset;
 	     i < dma_dom->aperture_size;
-	     i += PAGE_SIZE) {
-		u64 *pte = fetch_pte(&dma_dom->domain, i);
+	     i += pte_pgsize) {
+		u64 *pte = fetch_pte(&dma_dom->domain, i, &pte_pgsize);
 		if (!pte || !IOMMU_PTE_PRESENT(*pte))
 			continue;
 
-		dma_ops_reserve_addresses(dma_dom, i >> PAGE_SHIFT, 1);
+		dma_ops_reserve_addresses(dma_dom, i >> PAGE_SHIFT,
+					  pte_pgsize >> 12);
 	}
 
 	update_domain(&dma_dom->domain);
@@ -3439,27 +3432,21 @@ static phys_addr_t amd_iommu_iova_to_phy
 					  dma_addr_t iova)
 {
 	struct protection_domain *domain = dom->priv;
-	unsigned long offset_mask;
-	phys_addr_t paddr;
+	unsigned long offset_mask, pte_pgsize;
 	u64 *pte, __pte;
 
 	if (domain->mode == PAGE_MODE_NONE)
 		return iova;
 
-	pte = fetch_pte(domain, iova);
+	pte = fetch_pte(domain, iova, &pte_pgsize);
 
 	if (!pte || !IOMMU_PTE_PRESENT(*pte))
 		return 0;
 
-	if (PM_PTE_LEVEL(*pte) == 0)
-		offset_mask = PAGE_SIZE - 1;
-	else
-		offset_mask = PTE_PAGE_SIZE(*pte) - 1;
-
-	__pte = *pte & PM_ADDR_MASK;
-	paddr = (__pte & ~offset_mask) | (iova & offset_mask);
+	offset_mask = pte_pgsize - 1;
+	__pte	    = *pte & PM_ADDR_MASK;
 
-	return paddr;
+	return (__pte & ~offset_mask) | (iova & offset_mask);
 }
 
 static int amd_iommu_domain_has_cap(struct iommu_domain *domain,
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/iommu/amd_iommu_types.h linux-libre-3.12.44-gnu/drivers/iommu/amd_iommu_types.h
--- linux-libre-3.12.43-gnu/drivers/iommu/amd_iommu_types.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/iommu/amd_iommu_types.h	2015-06-10 09:27:29.000000000 -0400
@@ -276,6 +276,12 @@
 #define PTE_PAGE_SIZE(pte) \
 	(1ULL << (1 + ffz(((pte) | 0xfffULL))))
 
+/*
+ * Takes a page-table level and returns the default page-size for this level
+ */
+#define PTE_LEVEL_PAGE_SIZE(level)			\
+	(1ULL << (12 + (9 * (level))))
+
 #define IOMMU_PTE_P  (1ULL << 0)
 #define IOMMU_PTE_TV (1ULL << 1)
 #define IOMMU_PTE_U  (1ULL << 59)
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/isdn/icn/icn.c linux-libre-3.12.44-gnu/drivers/isdn/icn/icn.c
--- linux-libre-3.12.43-gnu/drivers/isdn/icn/icn.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/isdn/icn/icn.c	2015-06-10 09:27:29.000000000 -0400
@@ -1611,7 +1611,7 @@ icn_setup(char *line)
 	if (ints[0] > 1)
 		membase = (unsigned long)ints[2];
 	if (str && *str) {
-		strcpy(sid, str);
+		strlcpy(sid, str, sizeof(sid));
 		icn_id = sid;
 		if ((p = strchr(sid, ','))) {
 			*p++ = 0;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/lguest/core.c linux-libre-3.12.44-gnu/drivers/lguest/core.c
--- linux-libre-3.12.43-gnu/drivers/lguest/core.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/lguest/core.c	2015-06-10 09:27:29.000000000 -0400
@@ -176,7 +176,7 @@ static void unmap_switcher(void)
 bool lguest_address_ok(const struct lguest *lg,
 		       unsigned long addr, unsigned long len)
 {
-	return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
+	return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
 }
 
 /*
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/md/raid5.c linux-libre-3.12.44-gnu/drivers/md/raid5.c
--- linux-libre-3.12.43-gnu/drivers/md/raid5.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/md/raid5.c	2015-06-10 09:27:29.000000000 -0400
@@ -1812,7 +1812,8 @@ static int resize_stripes(struct r5conf
 
 	conf->slab_cache = sc;
 	conf->active_name = 1-conf->active_name;
-	conf->pool_size = newsize;
+	if (!err)
+		conf->pool_size = newsize;
 	return err;
 }
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/mmc/host/atmel-mci.c linux-libre-3.12.44-gnu/drivers/mmc/host/atmel-mci.c
--- linux-libre-3.12.43-gnu/drivers/mmc/host/atmel-mci.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/mmc/host/atmel-mci.c	2015-06-10 09:27:29.000000000 -0400
@@ -1301,7 +1301,7 @@ static void atmci_set_ios(struct mmc_hos
 
 	if (ios->clock) {
 		unsigned int clock_min = ~0U;
-		u32 clkdiv;
+		int clkdiv;
 
 		clk_prepare(host->mck);
 		unprepare_clk = true;
@@ -1330,7 +1330,12 @@ static void atmci_set_ios(struct mmc_hos
 		/* Calculate clock divider */
 		if (host->caps.has_odd_clk_div) {
 			clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2;
-			if (clkdiv > 511) {
+			if (clkdiv < 0) {
+				dev_warn(&mmc->class_dev,
+					 "clock %u too fast; using %lu\n",
+					 clock_min, host->bus_hz / 2);
+				clkdiv = 0;
+			} else if (clkdiv > 511) {
 				dev_warn(&mmc->class_dev,
 				         "clock %u too slow; using %lu\n",
 				         clock_min, host->bus_hz / (511 + 2));
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/net/phy/dp83640.c linux-libre-3.12.44-gnu/drivers/net/phy/dp83640.c
--- linux-libre-3.12.43-gnu/drivers/net/phy/dp83640.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/net/phy/dp83640.c	2015-06-10 09:27:29.000000000 -0400
@@ -45,7 +45,7 @@
 #define PSF_TX		0x1000
 #define EXT_EVENT	1
 #define CAL_EVENT	7
-#define CAL_TRIGGER	7
+#define CAL_TRIGGER	1
 #define PER_TRIGGER	6
 
 #define MII_DP83640_MICR 0x11
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/net/wireless/rt2x00/rt2800usb.c linux-libre-3.12.44-gnu/drivers/net/wireless/rt2x00/rt2800usb.c
--- linux-libre-3.12.43-gnu/drivers/net/wireless/rt2x00/rt2800usb.c	2015-05-21 09:53:56.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/net/wireless/rt2x00/rt2800usb.c	2015-06-16 04:25:56.000000000 -0400
@@ -994,6 +994,7 @@ static struct usb_device_id rt2800usb_de
 	{ USB_DEVICE(0x07d1, 0x3c17) },
 	{ USB_DEVICE(0x2001, 0x3317) },
 	{ USB_DEVICE(0x2001, 0x3c1b) },
+	{ USB_DEVICE(0x2001, 0x3c25) },
 	/* Draytek */
 	{ USB_DEVICE(0x07fa, 0x7712) },
 	/* DVICO */
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/net/wireless/rtlwifi/usb.c linux-libre-3.12.44-gnu/drivers/net/wireless/rtlwifi/usb.c
--- linux-libre-3.12.43-gnu/drivers/net/wireless/rtlwifi/usb.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/net/wireless/rtlwifi/usb.c	2015-06-10 09:27:29.000000000 -0400
@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read(
 
 	do {
 		status = usb_control_msg(udev, pipe, request, reqtype, value,
-					 index, pdata, len, 0); /*max. timeout*/
+					 index, pdata, len, 1000);
 		if (status < 0) {
 			/* firmware download is checksumed, don't retry */
 			if ((value >= FW_8192C_START_ADDRESS &&
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/net/xen-netback/xenbus.c linux-libre-3.12.44-gnu/drivers/net/xen-netback/xenbus.c
--- linux-libre-3.12.43-gnu/drivers/net/xen-netback/xenbus.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/net/xen-netback/xenbus.c	2015-06-10 09:27:29.000000000 -0400
@@ -33,6 +33,8 @@ struct backend_info {
 	enum xenbus_state frontend_state;
 	struct xenbus_watch hotplug_status_watch;
 	u8 have_hotplug_status_watch:1;
+
+	const char *hotplug_script;
 };
 
 static int connect_rings(struct backend_info *);
@@ -55,6 +57,7 @@ static int netback_remove(struct xenbus_
 		xenvif_free(be->vif);
 		be->vif = NULL;
 	}
+	kfree(be->hotplug_script);
 	kfree(be);
 	dev_set_drvdata(&dev->dev, NULL);
 	return 0;
@@ -72,6 +75,7 @@ static int netback_probe(struct xenbus_d
 	struct xenbus_transaction xbt;
 	int err;
 	int sg;
+	const char *script;
 	struct backend_info *be = kzalloc(sizeof(struct backend_info),
 					  GFP_KERNEL);
 	if (!be) {
@@ -142,6 +146,15 @@ static int netback_probe(struct xenbus_d
 	if (err)
 		pr_debug("Error writing feature-split-event-channels\n");
 
+	script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
+	if (IS_ERR(script)) {
+		err = PTR_ERR(script);
+		xenbus_dev_fatal(dev, err, "reading script");
+		goto fail;
+	}
+
+	be->hotplug_script = script;
+
 	err = xenbus_switch_state(dev, XenbusStateInitWait);
 	if (err)
 		goto fail;
@@ -172,22 +185,14 @@ static int netback_uevent(struct xenbus_
 			  struct kobj_uevent_env *env)
 {
 	struct backend_info *be = dev_get_drvdata(&xdev->dev);
-	char *val;
 
-	val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
-	if (IS_ERR(val)) {
-		int err = PTR_ERR(val);
-		xenbus_dev_fatal(xdev, err, "reading script");
-		return err;
-	} else {
-		if (add_uevent_var(env, "script=%s", val)) {
-			kfree(val);
-			return -ENOMEM;
-		}
-		kfree(val);
-	}
+	if (!be)
+		return 0;
 
-	if (!be || !be->vif)
+	if (add_uevent_var(env, "script=%s", be->hotplug_script))
+		return -ENOMEM;
+
+	if (!be->vif)
 		return 0;
 
 	return add_uevent_var(env, "vif=%s", be->vif->dev->name);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/nfc/pn533.c linux-libre-3.12.44-gnu/drivers/nfc/pn533.c
--- linux-libre-3.12.43-gnu/drivers/nfc/pn533.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/nfc/pn533.c	2015-06-10 09:27:29.000000000 -0400
@@ -2352,8 +2352,10 @@ static int pn533_data_exchange_complete(
 	}
 
 	skb = pn533_build_response(dev);
-	if (!skb)
+	if (!skb) {
+		rc = -ENOMEM;
 		goto error;
+	}
 
 	arg->cb(arg->cb_context, skb, 0);
 	kfree(arg);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/scsi/hpsa.c linux-libre-3.12.44-gnu/drivers/scsi/hpsa.c
--- linux-libre-3.12.43-gnu/drivers/scsi/hpsa.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/scsi/hpsa.c	2015-06-10 09:27:29.000000000 -0400
@@ -3920,10 +3920,6 @@ static int hpsa_kdump_hard_reset_control
 
 	/* Save the PCI command register */
 	pci_read_config_word(pdev, 4, &command_register);
-	/* Turn the board off.  This is so that later pci_restore_state()
-	 * won't turn the board on before the rest of config space is ready.
-	 */
-	pci_disable_device(pdev);
 	pci_save_state(pdev);
 
 	/* find the first memory BAR, so we can find the cfg table */
@@ -3971,11 +3967,6 @@ static int hpsa_kdump_hard_reset_control
 		goto unmap_cfgtable;
 
 	pci_restore_state(pdev);
-	rc = pci_enable_device(pdev);
-	if (rc) {
-		dev_warn(&pdev->dev, "failed to enable device.\n");
-		goto unmap_cfgtable;
-	}
 	pci_write_config_word(pdev, 4, command_register);
 
 	/* Some devices (notably the HP Smart Array 5i Controller)
@@ -4466,10 +4457,37 @@ static void hpsa_hba_inquiry(struct ctlr
 static int hpsa_init_reset_devices(struct pci_dev *pdev)
 {
 	int rc, i;
+	void __iomem *vaddr;
 
 	if (!reset_devices)
 		return 0;
 
+	/* kdump kernel is loading, we don't know in which state is
+	 * the pci interface. The dev->enable_cnt is equal zero
+	 * so we call enable+disable, wait a while and switch it on.
+	 */
+	rc = pci_enable_device(pdev);
+	if (rc) {
+		dev_warn(&pdev->dev, "Failed to enable PCI device\n");
+		return -ENODEV;
+	}
+	pci_disable_device(pdev);
+	msleep(260);			/* a randomly chosen number */
+	rc = pci_enable_device(pdev);
+	if (rc) {
+		dev_warn(&pdev->dev, "failed to enable device.\n");
+		return -ENODEV;
+	}
+	pci_set_master(pdev);
+
+	vaddr = pci_ioremap_bar(pdev, 0);
+	if (vaddr == NULL) {
+		rc = -ENOMEM;
+		goto out_disable;
+	}
+	writel(SA5_INTR_OFF, vaddr + SA5_REPLY_INTR_MASK_OFFSET);
+	iounmap(vaddr);
+
 	/* Reset the controller with a PCI power-cycle or via doorbell */
 	rc = hpsa_kdump_hard_reset_controller(pdev);
 
@@ -4478,10 +4496,11 @@ static int hpsa_init_reset_devices(struc
 	 * "performant mode".  Or, it might be 640x, which can't reset
 	 * due to concerns about shared bbwc between 6402/6404 pair.
 	 */
-	if (rc == -ENOTSUPP)
-		return rc; /* just try to do the kdump anyhow. */
-	if (rc)
-		return -ENODEV;
+	if (rc) {
+		if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */
+			rc = -ENODEV;
+		goto out_disable;
+	}
 
 	/* Now try to get the controller to respond to a no-op */
 	dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n");
@@ -4492,7 +4511,11 @@ static int hpsa_init_reset_devices(struc
 			dev_warn(&pdev->dev, "no-op failed%s\n",
 					(i < 11 ? "; re-trying" : ""));
 	}
-	return 0;
+
+out_disable:
+
+	pci_disable_device(pdev);
+	return rc;
 }
 
 static int hpsa_allocate_cmd_pool(struct ctlr_info *h)
@@ -4635,6 +4658,7 @@ static void hpsa_undo_allocations_after_
 		iounmap(h->transtable);
 	if (h->cfgtable)
 		iounmap(h->cfgtable);
+	pci_disable_device(h->pdev);
 	pci_release_regions(h->pdev);
 	kfree(h);
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/scsi/qla2xxx/qla_gbl.h linux-libre-3.12.44-gnu/drivers/scsi/qla2xxx/qla_gbl.h
--- linux-libre-3.12.43-gnu/drivers/scsi/qla2xxx/qla_gbl.h	2015-05-21 09:58:01.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/scsi/qla2xxx/qla_gbl.h	2015-06-16 04:30:38.000000000 -0400
@@ -721,8 +721,6 @@ extern void qla8044_set_idc_dontreset(st
 extern int qla8044_rd_direct(struct scsi_qla_host *vha, const uint32_t crb_reg);
 extern void qla8044_wr_direct(struct scsi_qla_host *vha,
 			      const uint32_t crb_reg, const uint32_t value);
-extern inline void qla8044_set_qsnt_ready(struct scsi_qla_host *vha);
-extern inline void qla8044_need_reset_handler(struct scsi_qla_host *vha);
 extern int qla8044_device_state_handler(struct scsi_qla_host *vha);
 extern void qla8044_clear_qsnt_ready(struct scsi_qla_host *vha);
 extern void qla8044_clear_drv_active(struct scsi_qla_host *vha);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/scsi/qla2xxx/qla_nx2.c linux-libre-3.12.44-gnu/drivers/scsi/qla2xxx/qla_nx2.c
--- linux-libre-3.12.43-gnu/drivers/scsi/qla2xxx/qla_nx2.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/scsi/qla2xxx/qla_nx2.c	2015-06-10 09:27:29.000000000 -0400
@@ -146,7 +146,7 @@ qla8044_rmw_crb_reg(struct scsi_qla_host
 	return;
 }
 
-inline void
+static inline void
 qla8044_set_qsnt_ready(struct scsi_qla_host *vha)
 {
 	uint32_t qsnt_state;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/scsi/sd.c linux-libre-3.12.44-gnu/drivers/scsi/sd.c
--- linux-libre-3.12.43-gnu/drivers/scsi/sd.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/scsi/sd.c	2015-06-10 09:27:29.000000000 -0400
@@ -1580,6 +1580,7 @@ static unsigned int sd_completed_bytes(s
 {
 	u64 start_lba = blk_rq_pos(scmd->request);
 	u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
+	u64 factor = scmd->device->sector_size / 512;
 	u64 bad_lba;
 	int info_valid;
 	/*
@@ -1601,16 +1602,9 @@ static unsigned int sd_completed_bytes(s
 	if (scsi_bufflen(scmd) <= scmd->device->sector_size)
 		return 0;
 
-	if (scmd->device->sector_size < 512) {
-		/* only legitimate sector_size here is 256 */
-		start_lba <<= 1;
-		end_lba <<= 1;
-	} else {
-		/* be careful ... don't want any overflows */
-		u64 factor = scmd->device->sector_size / 512;
-		do_div(start_lba, factor);
-		do_div(end_lba, factor);
-	}
+	/* be careful ... don't want any overflows */
+	do_div(start_lba, factor);
+	do_div(end_lba, factor);
 
 	/* The bad lba was reported incorrectly, we have no idea where
 	 * the error is.
@@ -2177,8 +2171,7 @@ got_data:
 	if (sector_size != 512 &&
 	    sector_size != 1024 &&
 	    sector_size != 2048 &&
-	    sector_size != 4096 &&
-	    sector_size != 256) {
+	    sector_size != 4096) {
 		sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
 			  sector_size);
 		/*
@@ -2229,8 +2222,6 @@ got_data:
 		sdkp->capacity <<= 2;
 	else if (sector_size == 1024)
 		sdkp->capacity <<= 1;
-	else if (sector_size == 256)
-		sdkp->capacity >>= 1;
 
 	blk_queue_physical_block_size(sdp->request_queue,
 				      sdkp->physical_block_size);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/scsi/storvsc_drv.c linux-libre-3.12.44-gnu/drivers/scsi/storvsc_drv.c
--- linux-libre-3.12.43-gnu/drivers/scsi/storvsc_drv.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/scsi/storvsc_drv.c	2015-06-10 09:27:29.000000000 -0400
@@ -1625,8 +1625,7 @@ static int storvsc_queuecommand(struct S
 		break;
 	default:
 		vm_srb->data_in = UNKNOWN_TYPE;
-		vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN |
-						     SRB_FLAGS_DATA_OUT);
+		vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER;
 		break;
 	}
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/dgap/dgap_driver.h linux-libre-3.12.44-gnu/drivers/staging/dgap/dgap_driver.h
--- linux-libre-3.12.43-gnu/drivers/staging/dgap/dgap_driver.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/dgap/dgap_driver.h	2015-06-10 09:27:29.000000000 -0400
@@ -53,6 +53,9 @@
  * DPR((fmt, args, ...));	Only prints if DGAP_TRACER is defined at
  *				  compile time and dgap_debug!=0
  */
+#define	DG_NAME		"dgap-1.3-16"
+#define	DG_PART		"40002347_C"
+
 #define	PROCSTR		"dgap"			/* /proc entries	 */
 #define	DEVSTR		"/dev/dg/dgap"		/* /dev entries		 */
 #define	DRVSTR		"dgap"			/* Driver name string 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/dgap/Makefile linux-libre-3.12.44-gnu/drivers/staging/dgap/Makefile
--- linux-libre-3.12.43-gnu/drivers/staging/dgap/Makefile	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/dgap/Makefile	2015-06-10 09:27:29.000000000 -0400
@@ -1,5 +1,3 @@
-EXTRA_CFLAGS += -DDG_NAME=\"dgap-1.3-16\" -DDG_PART=\"40002347_C\"
-
 obj-$(CONFIG_DGAP) += dgap.o
 
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/dgnc/dgnc_driver.h linux-libre-3.12.44-gnu/drivers/staging/dgnc/dgnc_driver.h
--- linux-libre-3.12.43-gnu/drivers/staging/dgnc/dgnc_driver.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/dgnc/dgnc_driver.h	2015-06-10 09:27:29.000000000 -0400
@@ -59,6 +59,8 @@
 #define	APR(args)	do { PRINTF_TO_KMEM(args); printk(DRVSTR": "); printk args; \
 			   } while (0)
 #define	RAPR(args)	do { PRINTF_TO_KMEM(args); printk args; } while (0)
+#define	DG_NAME		"dgnc-1.3-16"
+#define	DG_PART		"40002369_F"		/* RPM part number	 */
 
 #define TRC_TO_CONSOLE 1
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/dgnc/Makefile linux-libre-3.12.44-gnu/drivers/staging/dgnc/Makefile
--- linux-libre-3.12.43-gnu/drivers/staging/dgnc/Makefile	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/dgnc/Makefile	2015-06-10 09:27:29.000000000 -0400
@@ -1,5 +1,3 @@
-EXTRA_CFLAGS += -DDG_NAME=\"dgnc-1.3-16\" -DDG_PART=\"40002369_F\"
-
 obj-$(CONFIG_DGNC) += dgnc.o
 
 dgnc-objs :=   dgnc_cls.o dgnc_driver.o\
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/rtl8187se/ieee80211/ieee80211.h linux-libre-3.12.44-gnu/drivers/staging/rtl8187se/ieee80211/ieee80211.h
--- linux-libre-3.12.43-gnu/drivers/staging/rtl8187se/ieee80211/ieee80211.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/rtl8187se/ieee80211/ieee80211.h	2015-06-10 09:27:29.000000000 -0400
@@ -1447,12 +1447,12 @@ extern void ieee80211_sta_ps_send_null_f
 
 extern const long ieee80211_wlan_frequencies[];
 
-extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
+static inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
 {
 	ieee->scans++;
 }
 
-extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
+static inline int ieee80211_get_scans(struct ieee80211_device *ieee)
 {
 	return ieee->scans;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/rtl8188eu/Makefile linux-libre-3.12.44-gnu/drivers/staging/rtl8188eu/Makefile
--- linux-libre-3.12.43-gnu/drivers/staging/rtl8188eu/Makefile	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/rtl8188eu/Makefile	2015-06-10 09:27:29.000000000 -0400
@@ -1,5 +1,3 @@
-EXTRA_CFLAGS += -I$(src)/include
-
 r8188eu-y :=				\
 		core/rtw_ap.o		\
 		core/rtw_br_ext.o	\
@@ -67,4 +65,4 @@ r8188eu-y :=				\
 
 obj-$(CONFIG_R8188EU)	:= r8188eu.o
 
-ccflags-y += -D__CHECK_ENDIAN__
+ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/include
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/rtl8192e/rtllib.h linux-libre-3.12.44-gnu/drivers/staging/rtl8192e/rtllib.h
--- linux-libre-3.12.43-gnu/drivers/staging/rtl8192e/rtllib.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/rtl8192e/rtllib.h	2015-06-10 09:27:29.000000000 -0400
@@ -2761,7 +2761,6 @@ extern void rtllib_stop_scan(struct rtll
 extern bool rtllib_act_scanning(struct rtllib_device *ieee, bool sync_scan);
 extern void rtllib_stop_scan_syncro(struct rtllib_device *ieee);
 extern void rtllib_start_scan_syncro(struct rtllib_device *ieee, u8 is_mesh);
-extern inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee);
 extern u8 MgntQuery_MgntFrameTxRate(struct rtllib_device *ieee);
 extern void rtllib_sta_ps_send_null_frame(struct rtllib_device *ieee,
 					  short pwr);
@@ -2943,12 +2942,12 @@ void rtllib_softmac_scan_syncro(struct r
 
 extern const long rtllib_wlan_frequencies[];
 
-extern inline void rtllib_increment_scans(struct rtllib_device *ieee)
+static inline void rtllib_increment_scans(struct rtllib_device *ieee)
 {
 	ieee->scans++;
 }
 
-extern inline int rtllib_get_scans(struct rtllib_device *ieee)
+static inline int rtllib_get_scans(struct rtllib_device *ieee)
 {
 	return ieee->scans;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/rtl8192e/rtllib_softmac.c linux-libre-3.12.44-gnu/drivers/staging/rtl8192e/rtllib_softmac.c
--- linux-libre-3.12.43-gnu/drivers/staging/rtl8192e/rtllib_softmac.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/rtl8192e/rtllib_softmac.c	2015-06-10 09:27:29.000000000 -0400
@@ -341,7 +341,7 @@ inline void softmac_ps_mgmt_xmit(struct
 	}
 }
 
-inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee)
+static inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee)
 {
 	unsigned int len, rate_len;
 	u8 *tag;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/rtl8192u/ieee80211/ieee80211.h linux-libre-3.12.44-gnu/drivers/staging/rtl8192u/ieee80211/ieee80211.h
--- linux-libre-3.12.43-gnu/drivers/staging/rtl8192u/ieee80211/ieee80211.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/rtl8192u/ieee80211/ieee80211.h	2015-06-10 09:27:29.000000000 -0400
@@ -2250,7 +2250,7 @@ static inline void *ieee80211_priv(struc
 	return ((struct ieee80211_device *)netdev_priv(dev))->priv;
 }
 
-extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
+static inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
 {
 	/* Single white space is for Linksys APs */
 	if (essid_len == 1 && essid[0] == ' ')
@@ -2266,7 +2266,7 @@ extern inline int ieee80211_is_empty_ess
 	return 1;
 }
 
-extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode)
+static inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode)
 {
 	/*
 	 * It is possible for both access points and our device to support
@@ -2292,7 +2292,7 @@ extern inline int ieee80211_is_valid_mod
 	return 0;
 }
 
-extern inline int ieee80211_get_hdrlen(u16 fc)
+static inline int ieee80211_get_hdrlen(u16 fc)
 {
 	int hdrlen = IEEE80211_3ADDR_LEN;
 
@@ -2578,12 +2578,12 @@ void ieee80211_softmac_scan_syncro(struc
 
 extern const long ieee80211_wlan_frequencies[];
 
-extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
+static inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
 {
 	ieee->scans++;
 }
 
-extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
+static inline int ieee80211_get_scans(struct ieee80211_device *ieee)
 {
 	return ieee->scans;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/rtl8712/ieee80211.h linux-libre-3.12.44-gnu/drivers/staging/rtl8712/ieee80211.h
--- linux-libre-3.12.43-gnu/drivers/staging/rtl8712/ieee80211.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/rtl8712/ieee80211.h	2015-06-10 09:27:29.000000000 -0400
@@ -734,7 +734,7 @@ enum ieee80211_state {
 #define IEEE_G            (1<<2)
 #define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
 
-extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
+static inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
 {
 	/* Single white space is for Linksys APs */
 	if (essid_len == 1 && essid[0] == ' ')
@@ -748,7 +748,7 @@ extern inline int ieee80211_is_empty_ess
 	return 1;
 }
 
-extern inline int ieee80211_get_hdrlen(u16 fc)
+static inline int ieee80211_get_hdrlen(u16 fc)
 {
 	int hdrlen = 24;
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/staging/wlags49_h2/wl_internal.h linux-libre-3.12.44-gnu/drivers/staging/wlags49_h2/wl_internal.h
--- linux-libre-3.12.43-gnu/drivers/staging/wlags49_h2/wl_internal.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/staging/wlags49_h2/wl_internal.h	2015-06-10 09:27:29.000000000 -0400
@@ -1013,7 +1013,7 @@ static inline void wl_unlock(struct wl_p
 /* Interrupt enable disable functions                               */
 /********************************************************************/
 
-extern inline void wl_act_int_on(struct wl_private *lp)
+static inline void wl_act_int_on(struct wl_private *lp)
 {
 	/*
 	 * Only do something when the driver is handling
@@ -1025,7 +1025,7 @@ extern inline void wl_act_int_on(struct
 	}
 }
 
-extern inline void wl_act_int_off(struct wl_private *lp)
+static inline void wl_act_int_off(struct wl_private *lp)
 {
 	/*
 	 * Only do something when the driver is handling
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/target/target_core_pscsi.c linux-libre-3.12.44-gnu/drivers/target/target_core_pscsi.c
--- linux-libre-3.12.43-gnu/drivers/target/target_core_pscsi.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/target/target_core_pscsi.c	2015-06-10 09:27:29.000000000 -0400
@@ -520,6 +520,7 @@ static int pscsi_configure_device(struct
 					" pdv_host_id: %d\n", pdv->pdv_host_id);
 				return -EINVAL;
 			}
+			pdv->pdv_lld_host = sh;
 		}
 	} else {
 		if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) {
@@ -602,6 +603,8 @@ static void pscsi_free_device(struct se_
 		if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
 		    (phv->phv_lld_host != NULL))
 			scsi_host_put(phv->phv_lld_host);
+		else if (pdv->pdv_lld_host)
+			scsi_host_put(pdv->pdv_lld_host);
 
 		if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
 			scsi_device_put(sd);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/target/target_core_pscsi.h linux-libre-3.12.44-gnu/drivers/target/target_core_pscsi.h
--- linux-libre-3.12.43-gnu/drivers/target/target_core_pscsi.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/target/target_core_pscsi.h	2015-06-10 09:27:29.000000000 -0400
@@ -45,6 +45,7 @@ struct pscsi_dev_virt {
 	int	pdv_lun_id;
 	struct block_device *pdv_bd;
 	struct scsi_device *pdv_sd;
+	struct Scsi_Host *pdv_lld_host;
 } ____cacheline_aligned;
 
 typedef enum phv_modes {
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/thermal/step_wise.c linux-libre-3.12.44-gnu/drivers/thermal/step_wise.c
--- linux-libre-3.12.43-gnu/drivers/thermal/step_wise.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/thermal/step_wise.c	2015-06-10 09:27:29.000000000 -0400
@@ -140,9 +140,6 @@ static void thermal_zone_trip_update(str
 		old_target = instance->target;
 		instance->target = get_target_state(instance, trend, throttle);
 
-		if (old_target == instance->target)
-			continue;
-
 		/* Activate a passive thermal instance */
 		if (old_target == THERMAL_NO_TARGET &&
 			instance->target != THERMAL_NO_TARGET)
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/tty/hvc/hvc_xen.c linux-libre-3.12.44-gnu/drivers/tty/hvc/hvc_xen.c
--- linux-libre-3.12.43-gnu/drivers/tty/hvc/hvc_xen.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/tty/hvc/hvc_xen.c	2015-06-10 09:27:29.000000000 -0400
@@ -289,7 +289,7 @@ static int xen_initial_domain_console_in
 			return -ENOMEM;
 	}
 
-	info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
+	info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
 	info->vtermno = HVC_COOKIE;
 
 	spin_lock(&xencons_lock);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/chipidea/debug.c linux-libre-3.12.44-gnu/drivers/usb/chipidea/debug.c
--- linux-libre-3.12.43-gnu/drivers/usb/chipidea/debug.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/chipidea/debug.c	2015-06-10 09:27:29.000000000 -0400
@@ -84,9 +84,13 @@ static ssize_t ci_port_test_write(struct
 	char buf[32];
 	int ret;
 
-	if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+	count = min_t(size_t, sizeof(buf) - 1, count);
+	if (copy_from_user(buf, ubuf, count))
 		return -EFAULT;
 
+	/* sscanf requires a zero terminated string */
+	buf[count] = '\0';
+
 	if (sscanf(buf, "%u", &mode) != 1)
 		return -EINVAL;
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/core/quirks.c linux-libre-3.12.44-gnu/drivers/usb/core/quirks.c
--- linux-libre-3.12.43-gnu/drivers/usb/core/quirks.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/core/quirks.c	2015-06-10 09:27:29.000000000 -0400
@@ -105,6 +105,9 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x04f3, 0x010c), .driver_info =
 			USB_QUIRK_DEVICE_QUALIFIER },
 
+	{ USB_DEVICE(0x04f3, 0x0125), .driver_info =
+			USB_QUIRK_DEVICE_QUALIFIER },
+
 	{ USB_DEVICE(0x04f3, 0x016f), .driver_info =
 			USB_QUIRK_DEVICE_QUALIFIER },
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/gadget/configfs.c linux-libre-3.12.44-gnu/drivers/usb/gadget/configfs.c
--- linux-libre-3.12.43-gnu/drivers/usb/gadget/configfs.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/gadget/configfs.c	2015-06-10 09:27:29.000000000 -0400
@@ -757,6 +757,7 @@ static void purge_configs_funcs(struct g
 			}
 		}
 		c->next_interface_id = 0;
+		memset(c->interface, 0, sizeof(c->interface));
 		c->superspeed = 0;
 		c->highspeed = 0;
 		c->fullspeed = 0;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/host/xhci.h linux-libre-3.12.44-gnu/drivers/usb/host/xhci.h
--- linux-libre-3.12.43-gnu/drivers/usb/host/xhci.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/host/xhci.h	2015-06-10 09:27:29.000000000 -0400
@@ -1262,7 +1262,7 @@ union xhci_trb {
  * since the command ring is 64-byte aligned.
  * It must also be greater than 16.
  */
-#define TRBS_PER_SEGMENT	64
+#define TRBS_PER_SEGMENT	256
 /* Allow two commands + a link TRB, along with any reserved command TRBs */
 #define MAX_RSVD_CMD_TRBS	(TRBS_PER_SEGMENT - 3)
 #define TRB_SEGMENT_SIZE	(TRBS_PER_SEGMENT*16)
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/host/xhci-ring.c linux-libre-3.12.44-gnu/drivers/usb/host/xhci-ring.c
--- linux-libre-3.12.43-gnu/drivers/usb/host/xhci-ring.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/host/xhci-ring.c	2015-06-10 09:27:29.000000000 -0400
@@ -2180,8 +2180,13 @@ static int process_isoc_td(struct xhci_h
 		break;
 	case COMP_DEV_ERR:
 	case COMP_STALL:
+		frame->status = -EPROTO;
+		skip_td = true;
+		break;
 	case COMP_TX_ERR:
 		frame->status = -EPROTO;
+		if (event_trb != td->last_trb)
+			return 0;
 		skip_td = true;
 		break;
 	case COMP_STOP:
@@ -2789,7 +2794,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd
 		xhci_halt(xhci);
 hw_died:
 		spin_unlock(&xhci->lock);
-		return -ESHUTDOWN;
+		return IRQ_HANDLED;
 	}
 
 	/*
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/serial/cp210x.c linux-libre-3.12.44-gnu/drivers/usb/serial/cp210x.c
--- linux-libre-3.12.43-gnu/drivers/usb/serial/cp210x.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/serial/cp210x.c	2015-06-10 09:27:29.000000000 -0400
@@ -127,6 +127,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
 	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
+	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/serial/pl2303.c linux-libre-3.12.44-gnu/drivers/usb/serial/pl2303.c
--- linux-libre-3.12.43-gnu/drivers/usb/serial/pl2303.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/serial/pl2303.c	2015-06-10 09:27:29.000000000 -0400
@@ -64,7 +64,6 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
 	{ USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
-	{ USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/serial/pl2303.h linux-libre-3.12.44-gnu/drivers/usb/serial/pl2303.h
--- linux-libre-3.12.43-gnu/drivers/usb/serial/pl2303.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/serial/pl2303.h	2015-06-10 09:27:29.000000000 -0400
@@ -62,10 +62,6 @@
 #define ALCATEL_VENDOR_ID	0x11f7
 #define ALCATEL_PRODUCT_ID	0x02df
 
-/* Samsung I330 phone cradle */
-#define SAMSUNG_VENDOR_ID	0x04e8
-#define SAMSUNG_PRODUCT_ID	0x8001
-
 #define SIEMENS_VENDOR_ID	0x11f5
 #define SIEMENS_PRODUCT_ID_SX1	0x0001
 #define SIEMENS_PRODUCT_ID_X65	0x0003
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/serial/visor.c linux-libre-3.12.44-gnu/drivers/usb/serial/visor.c
--- linux-libre-3.12.43-gnu/drivers/usb/serial/visor.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/serial/visor.c	2015-06-10 09:27:29.000000000 -0400
@@ -96,7 +96,7 @@ static struct usb_device_id id_table []
 		.driver_info = (kernel_ulong_t)&palm_os_4_probe },
 	{ USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID),
 		.driver_info = (kernel_ulong_t)&palm_os_4_probe },
-	{ USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID),
+	{ USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff),
 		.driver_info = (kernel_ulong_t)&palm_os_4_probe },
 	{ USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID),
 		.driver_info = (kernel_ulong_t)&palm_os_4_probe },
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/usb/storage/unusual_devs.h linux-libre-3.12.44-gnu/drivers/usb/storage/unusual_devs.h
--- linux-libre-3.12.43-gnu/drivers/usb/storage/unusual_devs.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/usb/storage/unusual_devs.h	2015-06-10 09:27:29.000000000 -0400
@@ -766,6 +766,13 @@ UNUSUAL_DEV(  0x059f, 0x0643, 0x0000, 0x
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_GO_SLOW ),
 
+/* Reported by Christian Schaller <cschalle@redhat.com> */
+UNUSUAL_DEV(  0x059f, 0x0651, 0x0000, 0x0000,
+		"LaCie",
+		"External HDD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_WP_DETECT ),
+
 /* Submitted by Joel Bourquard <numlock@freesurf.ch>
  * Some versions of this device need the SubClass and Protocol overrides
  * while others don't.
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/vhost/scsi.c linux-libre-3.12.44-gnu/drivers/vhost/scsi.c
--- linux-libre-3.12.43-gnu/drivers/vhost/scsi.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/vhost/scsi.c	2015-06-10 09:27:29.000000000 -0400
@@ -1132,7 +1132,7 @@ tcm_vhost_send_evt(struct vhost_scsi *vs
 		 * lun[4-7] need to be zero according to virtio-scsi spec.
 		 */
 		evt->event.lun[0] = 0x01;
-		evt->event.lun[1] = tpg->tport_tpgt & 0xFF;
+		evt->event.lun[1] = tpg->tport_tpgt;
 		if (lun->unpacked_lun >= 256)
 			evt->event.lun[2] = lun->unpacked_lun >> 8 | 0x40 ;
 		evt->event.lun[3] = lun->unpacked_lun & 0xFF;
@@ -2002,12 +2002,12 @@ tcm_vhost_make_tpg(struct se_wwn *wwn,
 			struct tcm_vhost_tport, tport_wwn);
 
 	struct tcm_vhost_tpg *tpg;
-	unsigned long tpgt;
+	u16 tpgt;
 	int ret;
 
 	if (strstr(name, "tpgt_") != name)
 		return ERR_PTR(-EINVAL);
-	if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX)
+	if (kstrtou16(name + 5, 10, &tpgt) || tpgt >= VHOST_SCSI_MAX_TARGET)
 		return ERR_PTR(-EINVAL);
 
 	tpg = kzalloc(sizeof(struct tcm_vhost_tpg), GFP_KERNEL);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/w1/masters/ds2490.c linux-libre-3.12.44-gnu/drivers/w1/masters/ds2490.c
--- linux-libre-3.12.43-gnu/drivers/w1/masters/ds2490.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/w1/masters/ds2490.c	2015-06-10 09:27:29.000000000 -0400
@@ -246,7 +246,7 @@ static int ds_recv_status_nodump(struct
 	memset(st, 0, sizeof(*st));
 
 	count = 0;
-	err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_STATUS]), buf, size, &count, 100);
+	err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_STATUS]), buf, size, &count, 1000);
 	if (err < 0) {
 		printk(KERN_ERR "Failed to read 1-wire data from 0x%x: err=%d.\n", dev->ep[EP_STATUS], err);
 		return err;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/drivers/xen/events.c linux-libre-3.12.44-gnu/drivers/xen/events.c
--- linux-libre-3.12.43-gnu/drivers/xen/events.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/drivers/xen/events.c	2015-06-10 09:27:29.000000000 -0400
@@ -959,7 +959,7 @@ static int find_virq(unsigned int virq,
 	return rc;
 }
 
-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
 {
 	struct evtchn_bind_virq bind_virq;
 	int evtchn, irq, ret;
@@ -973,8 +973,12 @@ int bind_virq_to_irq(unsigned int virq,
 		if (irq < 0)
 			goto out;
 
-		irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
-					      handle_percpu_irq, "virq");
+		if (percpu)
+			irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+						      handle_percpu_irq, "virq");
+		else
+			irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
+						      handle_edge_irq, "virq");
 
 		bind_virq.virq = virq;
 		bind_virq.vcpu = cpu;
@@ -1101,7 +1105,7 @@ int bind_virq_to_irqhandler(unsigned int
 {
 	int irq, retval;
 
-	irq = bind_virq_to_irq(virq, cpu);
+	irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
 	if (irq < 0)
 		return irq;
 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/aio.c linux-libre-3.12.44-gnu/fs/aio.c
--- linux-libre-3.12.43-gnu/fs/aio.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/aio.c	2015-06-10 09:27:29.000000000 -0400
@@ -77,6 +77,11 @@ struct kioctx_cpu {
 	unsigned		reqs_available;
 };
 
+struct ctx_rq_wait {
+	struct completion comp;
+	atomic_t count;
+};
+
 struct kioctx {
 	struct percpu_ref	users;
 	atomic_t		dead;
@@ -115,7 +120,7 @@ struct kioctx {
 	/*
 	 * signals when all in-flight requests are done
 	 */
-	struct completion *requests_done;
+	struct ctx_rq_wait	*rq_wait;
 
 	struct {
 		/*
@@ -521,8 +526,8 @@ static void free_ioctx_reqs(struct percp
 	struct kioctx *ctx = container_of(ref, struct kioctx, reqs);
 
 	/* At this point we know that there are no any in-flight requests */
-	if (ctx->requests_done)
-		complete(ctx->requests_done);
+	if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count))
+		complete(&ctx->rq_wait->comp);
 
 	INIT_WORK(&ctx->free_work, free_ioctx);
 	schedule_work(&ctx->free_work);
@@ -738,7 +743,7 @@ err:
  *	the rapid destruction of the kioctx.
  */
 static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx,
-		struct completion *requests_done)
+		      struct ctx_rq_wait *wait)
 {
 	if (!atomic_xchg(&ctx->dead, 1)) {
 		struct kioctx_table *table;
@@ -767,11 +772,11 @@ static void kill_ioctx(struct mm_struct
 		if (ctx->mmap_size)
 			vm_munmap(ctx->mmap_base, ctx->mmap_size);
 
-		ctx->requests_done = requests_done;
+		ctx->rq_wait = wait;
 		percpu_ref_kill(&ctx->users);
 	} else {
-		if (requests_done)
-			complete(requests_done);
+		if (wait && atomic_dec_and_test(&wait->count))
+			complete(&wait->comp);
 	}
 }
 
@@ -801,46 +806,44 @@ EXPORT_SYMBOL(wait_on_sync_kiocb);
  */
 void exit_aio(struct mm_struct *mm)
 {
-	struct kioctx_table *table;
-	struct kioctx *ctx;
-	unsigned i = 0;
-
-	while (1) {
-		struct completion requests_done =
-			COMPLETION_INITIALIZER_ONSTACK(requests_done);
+	struct kioctx_table *table = rcu_dereference_raw(mm->ioctx_table);
+	struct ctx_rq_wait wait;
+	int i, skipped;
 
-		rcu_read_lock();
-		table = rcu_dereference(mm->ioctx_table);
+	if (!table)
+		return;
 
-		do {
-			if (!table || i >= table->nr) {
-				rcu_read_unlock();
-				rcu_assign_pointer(mm->ioctx_table, NULL);
-				if (table)
-					kfree(table);
-				return;
-			}
+	atomic_set(&wait.count, table->nr);
+	init_completion(&wait.comp);
 
-			ctx = table->table[i++];
-		} while (!ctx);
+	skipped = 0;
+	for (i = 0; i < table->nr; ++i) {
+		struct kioctx *ctx = table->table[i];
 
-		rcu_read_unlock();
+		if (!ctx) {
+			skipped++;
+			continue;
+		}
 
 		/*
-		 * We don't need to bother with munmap() here -
-		 * exit_mmap(mm) is coming and it'll unmap everything.
-		 * Since aio_free_ring() uses non-zero ->mmap_size
-		 * as indicator that it needs to unmap the area,
-		 * just set it to 0; aio_free_ring() is the only
-		 * place that uses ->mmap_size, so it's safe.
+		 * We don't need to bother with munmap() here - exit_mmap(mm)
+		 * is coming and it'll unmap everything. And we simply can't,
+		 * this is not necessarily our ->mm.
+		 * Since kill_ioctx() uses non-zero ->mmap_size as indicator
+		 * that it needs to unmap the area, just set it to 0.
 		 */
 		ctx->mmap_size = 0;
 
-		kill_ioctx(mm, ctx, &requests_done);
+		kill_ioctx(mm, ctx, &wait);
+	}
 
+	if (!atomic_sub_and_test(skipped, &wait.count)) {
 		/* Wait until all IO for the context are done. */
-		wait_for_completion(&requests_done);
+		wait_for_completion(&wait.comp);
 	}
+
+	RCU_INIT_POINTER(mm->ioctx_table, NULL);
+	kfree(table);
 }
 
 static void put_reqs_available(struct kioctx *ctx, unsigned nr)
@@ -1248,21 +1251,23 @@ SYSCALL_DEFINE1(io_destroy, aio_context_
 {
 	struct kioctx *ioctx = lookup_ioctx(ctx);
 	if (likely(NULL != ioctx)) {
-		struct completion requests_done =
-			COMPLETION_INITIALIZER_ONSTACK(requests_done);
+		struct ctx_rq_wait wait;
+
+		init_completion(&wait.comp);
+		atomic_set(&wait.count, 1);
 
 		/* Pass requests_done to kill_ioctx() where it can be set
 		 * in a thread-safe way. If we try to set it here then we have
 		 * a race condition if two io_destroy() called simultaneously.
 		 */
-		kill_ioctx(current->mm, ioctx, &requests_done);
+		kill_ioctx(current->mm, ioctx, &wait);
 		percpu_ref_put(&ioctx->users);
 
 		/* Wait until all IO for the context are done. Otherwise kernel
 		 * keep using user-space buffers even if user thinks the context
 		 * is destroyed.
 		 */
-		wait_for_completion(&requests_done);
+		wait_for_completion(&wait.comp);
 
 		return 0;
 	}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/binfmt_elf.c linux-libre-3.12.44-gnu/fs/binfmt_elf.c
--- linux-libre-3.12.43-gnu/fs/binfmt_elf.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/binfmt_elf.c	2015-06-10 09:27:29.000000000 -0400
@@ -822,7 +822,7 @@ static int load_elf_binary(struct linux_
 			total_size = total_mapping_size(elf_phdata,
 							loc->elf_ex.e_phnum);
 			if (!total_size) {
-				error = -EINVAL;
+				retval = -EINVAL;
 				goto out_free_dentry;
 			}
 		}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/cifs/smb2pdu.c linux-libre-3.12.44-gnu/fs/cifs/smb2pdu.c
--- linux-libre-3.12.43-gnu/fs/cifs/smb2pdu.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/cifs/smb2pdu.c	2015-06-10 09:27:29.000000000 -0400
@@ -1228,6 +1228,7 @@ SMB2_ioctl(const unsigned int xid, struc
 
 	cifs_dbg(FYI, "SMB2 IOCTL\n");
 
+	*out_data = NULL;
 	/* zero out returned data len, in case of error */
 	if (plen)
 		*plen = 0;
@@ -1273,11 +1274,23 @@ SMB2_ioctl(const unsigned int xid, struc
 		req->Flags = 0;
 
 	iov[0].iov_base = (char *)req;
-	/* 4 for rfc1002 length field */
-	iov[0].iov_len = get_rfc1002_length(req) + 4;
 
-	if (indatalen)
-		inc_rfc1001_len(req, indatalen);
+	/*
+	 * If no input data, the size of ioctl struct in
+	 * protocol spec still includes a 1 byte data buffer,
+	 * but if input data passed to ioctl, we do not
+	 * want to double count this, so we do not send
+	 * the dummy one byte of data in iovec[0] if sending
+	 * input data (in iovec[1]). We also must add 4 bytes
+	 * in first iovec to allow for rfc1002 length field.
+	 */
+
+	if (indatalen) {
+		iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
+		inc_rfc1001_len(req, indatalen - 1);
+	} else
+		iov[0].iov_len = get_rfc1002_length(req) + 4;
+
 
 	rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
 	rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/dcache.c linux-libre-3.12.44-gnu/fs/dcache.c
--- linux-libre-3.12.43-gnu/fs/dcache.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/dcache.c	2015-06-10 09:27:29.000000000 -0400
@@ -1154,13 +1154,13 @@ ascend:
 		/* might go back up the wrong parent if we have had a rename. */
 		if (need_seqretry(&rename_lock, seq))
 			goto rename_retry;
-		next = child->d_child.next;
-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
+		/* go into the first sibling still alive */
+		do {
+			next = child->d_child.next;
 			if (next == &this_parent->d_subdirs)
 				goto ascend;
 			child = list_entry(next, struct dentry, d_child);
-			next = next->next;
-		}
+		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
 		rcu_read_unlock();
 		goto resume;
 	}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/ext4/ext4_jbd2.c linux-libre-3.12.44-gnu/fs/ext4/ext4_jbd2.c
--- linux-libre-3.12.43-gnu/fs/ext4/ext4_jbd2.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/ext4/ext4_jbd2.c	2015-06-10 09:27:29.000000000 -0400
@@ -87,6 +87,12 @@ int __ext4_journal_stop(const char *wher
 		ext4_put_nojournal(handle);
 		return 0;
 	}
+
+	if (!handle->h_transaction) {
+		err = jbd2_journal_stop(handle);
+		return handle->h_err ? handle->h_err : err;
+	}
+
 	sb = handle->h_transaction->t_journal->j_private;
 	err = handle->h_err;
 	rc = jbd2_journal_stop(handle);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/ext4/extents.c linux-libre-3.12.44-gnu/fs/ext4/extents.c
--- linux-libre-3.12.43-gnu/fs/ext4/extents.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/ext4/extents.c	2015-06-10 09:27:29.000000000 -0400
@@ -361,7 +361,7 @@ static int ext4_valid_extent(struct inod
 	ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
 	ext4_lblk_t last = lblock + len - 1;
 
-	if (lblock > last)
+	if (len == 0 || lblock > last)
 		return 0;
 	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/fhandle.c linux-libre-3.12.44-gnu/fs/fhandle.c
--- linux-libre-3.12.43-gnu/fs/fhandle.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/fhandle.c	2015-06-10 09:27:29.000000000 -0400
@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd
 		goto out_err;
 	}
 	/* copy the full handle */
-	if (copy_from_user(handle, ufh,
-			   sizeof(struct file_handle) +
+	*handle = f_handle;
+	if (copy_from_user(&handle->f_handle,
+			   &ufh->f_handle,
 			   f_handle.handle_bytes)) {
 		retval = -EFAULT;
 		goto out_handle;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/jbd2/recovery.c linux-libre-3.12.44-gnu/fs/jbd2/recovery.c
--- linux-libre-3.12.43-gnu/fs/jbd2/recovery.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/jbd2/recovery.c	2015-06-10 09:27:29.000000000 -0400
@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t
 {
 	jbd2_journal_revoke_header_t *header;
 	int offset, max;
+	int csum_size = 0;
+	__u32 rcount;
 	int record_len = 4;
 
 	header = (jbd2_journal_revoke_header_t *) bh->b_data;
 	offset = sizeof(jbd2_journal_revoke_header_t);
-	max = be32_to_cpu(header->r_count);
+	rcount = be32_to_cpu(header->r_count);
 
 	if (!jbd2_revoke_block_csum_verify(journal, header))
 		return -EINVAL;
 
+	if (jbd2_journal_has_csum_v2or3(journal))
+		csum_size = sizeof(struct jbd2_journal_revoke_tail);
+	if (rcount > journal->j_blocksize - csum_size)
+		return -EINVAL;
+	max = rcount;
+
 	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
 		record_len = 8;
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/jbd2/revoke.c linux-libre-3.12.44-gnu/fs/jbd2/revoke.c
--- linux-libre-3.12.43-gnu/fs/jbd2/revoke.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/jbd2/revoke.c	2015-06-10 09:27:29.000000000 -0400
@@ -583,7 +583,7 @@ static void write_one_revoke_record(jour
 {
 	int csum_size = 0;
 	struct buffer_head *descriptor;
-	int offset;
+	int sz, offset;
 	journal_header_t *header;
 
 	/* If we are already aborting, this all becomes a noop.  We
@@ -600,9 +600,14 @@ static void write_one_revoke_record(jour
 	if (jbd2_journal_has_csum_v2or3(journal))
 		csum_size = sizeof(struct jbd2_journal_revoke_tail);
 
+	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+		sz = 8;
+	else
+		sz = 4;
+
 	/* Make sure we have a descriptor with space left for the record */
 	if (descriptor) {
-		if (offset >= journal->j_blocksize - csum_size) {
+		if (offset + sz > journal->j_blocksize - csum_size) {
 			flush_descriptor(journal, descriptor, offset, write_op);
 			descriptor = NULL;
 		}
@@ -625,16 +630,13 @@ static void write_one_revoke_record(jour
 		*descriptorp = descriptor;
 	}
 
-	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) {
+	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
 		* ((__be64 *)(&descriptor->b_data[offset])) =
 			cpu_to_be64(record->blocknr);
-		offset += 8;
-
-	} else {
+	else
 		* ((__be32 *)(&descriptor->b_data[offset])) =
 			cpu_to_be32(record->blocknr);
-		offset += 4;
-	}
+	offset += sz;
 
 	*offsetp = offset;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/jbd2/transaction.c linux-libre-3.12.44-gnu/fs/jbd2/transaction.c
--- linux-libre-3.12.43-gnu/fs/jbd2/transaction.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/jbd2/transaction.c	2015-06-10 09:27:29.000000000 -0400
@@ -551,7 +551,6 @@ int jbd2_journal_extend(handle_t *handle
 	int result;
 	int wanted;
 
-	WARN_ON(!transaction);
 	if (is_handle_aborted(handle))
 		return -EROFS;
 	journal = transaction->t_journal;
@@ -627,7 +626,6 @@ int jbd2__journal_restart(handle_t *hand
 	tid_t		tid;
 	int		need_to_start, ret;
 
-	WARN_ON(!transaction);
 	/* If we've had an abort of any type, don't even think about
 	 * actually doing the restart! */
 	if (is_handle_aborted(handle))
@@ -791,7 +789,6 @@ do_get_write_access(handle_t *handle, st
 	int need_copy = 0;
 	unsigned long start_lock, time_lock;
 
-	WARN_ON(!transaction);
 	if (is_handle_aborted(handle))
 		return -EROFS;
 	journal = transaction->t_journal;
@@ -1057,7 +1054,6 @@ int jbd2_journal_get_create_access(handl
 	int err;
 
 	jbd_debug(5, "journal_head %p\n", jh);
-	WARN_ON(!transaction);
 	err = -EROFS;
 	if (is_handle_aborted(handle))
 		goto out;
@@ -1271,7 +1267,6 @@ int jbd2_journal_dirty_metadata(handle_t
 	struct journal_head *jh;
 	int ret = 0;
 
-	WARN_ON(!transaction);
 	if (is_handle_aborted(handle))
 		return -EROFS;
 	journal = transaction->t_journal;
@@ -1407,7 +1402,6 @@ int jbd2_journal_forget (handle_t *handl
 	int err = 0;
 	int was_modified = 0;
 
-	WARN_ON(!transaction);
 	if (is_handle_aborted(handle))
 		return -EROFS;
 	journal = transaction->t_journal;
@@ -1538,8 +1532,22 @@ int jbd2_journal_stop(handle_t *handle)
 	tid_t tid;
 	pid_t pid;
 
-	if (!transaction)
-		goto free_and_exit;
+	if (!transaction) {
+		/*
+		 * Handle is already detached from the transaction so
+		 * there is nothing to do other than decrease a refcount,
+		 * or free the handle if refcount drops to zero
+		 */
+		if (--handle->h_ref > 0) {
+			jbd_debug(4, "h_ref %d -> %d\n", handle->h_ref + 1,
+							 handle->h_ref);
+			return err;
+		} else {
+			if (handle->h_rsv_handle)
+				jbd2_free_handle(handle->h_rsv_handle);
+			goto free_and_exit;
+		}
+	}
 	journal = transaction->t_journal;
 
 	J_ASSERT(journal_current_handle() == handle);
@@ -2381,7 +2389,6 @@ int jbd2_journal_file_inode(handle_t *ha
 	transaction_t *transaction = handle->h_transaction;
 	journal_t *journal;
 
-	WARN_ON(!transaction);
 	if (is_handle_aborted(handle))
 		return -EROFS;
 	journal = transaction->t_journal;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/namespace.c linux-libre-3.12.44-gnu/fs/namespace.c
--- linux-libre-3.12.43-gnu/fs/namespace.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/namespace.c	2015-06-10 09:27:29.000000000 -0400
@@ -1467,8 +1467,11 @@ struct vfsmount *collect_mounts(struct p
 {
 	struct mount *tree;
 	namespace_lock();
-	tree = copy_tree(real_mount(path->mnt), path->dentry,
-			 CL_COPY_ALL | CL_PRIVATE);
+	if (!check_mnt(real_mount(path->mnt)))
+		tree = ERR_PTR(-EINVAL);
+	else
+		tree = copy_tree(real_mount(path->mnt), path->dentry,
+				 CL_COPY_ALL | CL_PRIVATE);
 	namespace_unlock();
 	if (IS_ERR(tree))
 		return ERR_CAST(tree);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/fs/omfs/inode.c linux-libre-3.12.44-gnu/fs/omfs/inode.c
--- linux-libre-3.12.43-gnu/fs/omfs/inode.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/fs/omfs/inode.c	2015-06-10 09:27:29.000000000 -0400
@@ -361,7 +361,7 @@ nomem:
 }
 
 enum {
-	Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
+	Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
 };
 
 static const match_table_t tokens = {
@@ -370,6 +370,7 @@ static const match_table_t tokens = {
 	{Opt_umask, "umask=%o"},
 	{Opt_dmask, "dmask=%o"},
 	{Opt_fmask, "fmask=%o"},
+	{Opt_err, NULL},
 };
 
 static int parse_options(char *options, struct omfs_sb_info *sbi)
diff -druNp --no-dereference linux-libre-3.12.43-gnu/include/drm/drm_pciids.h linux-libre-3.12.44-gnu/include/drm/drm_pciids.h
--- linux-libre-3.12.43-gnu/include/drm/drm_pciids.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/include/drm/drm_pciids.h	2015-06-10 09:27:29.000000000 -0400
@@ -186,6 +186,7 @@
 	{0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
 	{0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
 	{0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+	{0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
 	{0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
 	{0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
 	{0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff -druNp --no-dereference linux-libre-3.12.43-gnu/include/linux/libata.h linux-libre-3.12.44-gnu/include/linux/libata.h
--- linux-libre-3.12.43-gnu/include/linux/libata.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/include/linux/libata.h	2015-06-10 09:27:29.000000000 -0400
@@ -204,6 +204,7 @@ enum {
 	ATA_LFLAG_SW_ACTIVITY	= (1 << 7), /* keep activity stats */
 	ATA_LFLAG_NO_LPM	= (1 << 8), /* disable LPM on this link */
 	ATA_LFLAG_RST_ONCE	= (1 << 9), /* limit recovery to one reset */
+	ATA_LFLAG_CHANGED	= (1 << 10), /* LPM state changed on this link */
 
 	/* struct ata_port flags */
 	ATA_FLAG_SLAVE_POSS	= (1 << 0), /* host supports slave dev */
@@ -307,6 +308,12 @@ enum {
 	 */
 	ATA_TMOUT_PMP_SRST_WAIT	= 5000,
 
+	/* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
+	 * be a spurious PHY event, so ignore the first PHY event that
+	 * occurs within 10s after the policy change.
+	 */
+	ATA_TMOUT_SPURIOUS_PHY	= 10000,
+
 	/* ATA bus states */
 	BUS_UNKNOWN		= 0,
 	BUS_DMA			= 1,
@@ -785,6 +792,8 @@ struct ata_link {
 	struct ata_eh_context	eh_context;
 
 	struct ata_device	device[ATA_MAX_DEVICES];
+
+	unsigned long		last_lpm_change; /* when last LPM change happened */
 };
 #define ATA_LINK_CLEAR_BEGIN		offsetof(struct ata_link, active_tag)
 #define ATA_LINK_CLEAR_END		offsetof(struct ata_link, device[0])
@@ -1201,6 +1210,7 @@ extern struct ata_device *ata_dev_pair(s
 extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
 extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
 extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
+extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
 
 extern int ata_cable_40wire(struct ata_port *ap);
 extern int ata_cable_80wire(struct ata_port *ap);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/include/linux/pci_ids.h linux-libre-3.12.44-gnu/include/linux/pci_ids.h
--- linux-libre-3.12.43-gnu/include/linux/pci_ids.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/include/linux/pci_ids.h	2015-06-10 09:27:29.000000000 -0400
@@ -528,6 +528,8 @@
 #define PCI_DEVICE_ID_AMD_15H_NB_F5	0x1605
 #define PCI_DEVICE_ID_AMD_16H_NB_F3	0x1533
 #define PCI_DEVICE_ID_AMD_16H_NB_F4	0x1534
+#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F3 0x1583
+#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F4 0x1584
 #define PCI_DEVICE_ID_AMD_CNB17H_F3	0x1703
 #define PCI_DEVICE_ID_AMD_LANCE		0x2000
 #define PCI_DEVICE_ID_AMD_LANCE_HOME	0x2001
diff -druNp --no-dereference linux-libre-3.12.43-gnu/include/xen/events.h linux-libre-3.12.44-gnu/include/xen/events.h
--- linux-libre-3.12.43-gnu/include/xen/events.h	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/include/xen/events.h	2015-06-10 09:27:29.000000000 -0400
@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned i
 			      irq_handler_t handler,
 			      unsigned long irqflags, const char *devname,
 			      void *dev_id);
-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
+int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
 int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
 			    irq_handler_t handler,
 			    unsigned long irqflags, const char *devname,
diff -druNp --no-dereference linux-libre-3.12.43-gnu/kernel/fork.c linux-libre-3.12.44-gnu/kernel/fork.c
--- linux-libre-3.12.43-gnu/kernel/fork.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/kernel/fork.c	2015-06-10 09:27:29.000000000 -0400
@@ -1362,10 +1362,11 @@ static struct task_struct *copy_process(
 		goto bad_fork_cleanup_io;
 
 	if (pid != &init_struct_pid) {
-		retval = -ENOMEM;
 		pid = alloc_pid(p->nsproxy->pid_ns_for_children);
-		if (!pid)
+		if (IS_ERR(pid)) {
+			retval = PTR_ERR(pid);
 			goto bad_fork_cleanup_io;
+		}
 	}
 
 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/kernel/pid.c linux-libre-3.12.44-gnu/kernel/pid.c
--- linux-libre-3.12.43-gnu/kernel/pid.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/kernel/pid.c	2015-06-10 09:27:29.000000000 -0400
@@ -179,7 +179,7 @@ static int alloc_pidmap(struct pid_names
 			spin_unlock_irq(&pidmap_lock);
 			kfree(page);
 			if (unlikely(!map->page))
-				break;
+				return -ENOMEM;
 		}
 		if (likely(atomic_read(&map->nr_free))) {
 			for ( ; ; ) {
@@ -207,7 +207,7 @@ static int alloc_pidmap(struct pid_names
 		}
 		pid = mk_pid(pid_ns, map, offset);
 	}
-	return -1;
+	return -EAGAIN;
 }
 
 int next_pidmap(struct pid_namespace *pid_ns, unsigned int last)
@@ -298,17 +298,20 @@ struct pid *alloc_pid(struct pid_namespa
 	int i, nr;
 	struct pid_namespace *tmp;
 	struct upid *upid;
+	int retval = -ENOMEM;
 
 	pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL);
 	if (!pid)
-		goto out;
+		return ERR_PTR(retval);
 
 	tmp = ns;
 	pid->level = ns->level;
 	for (i = ns->level; i >= 0; i--) {
 		nr = alloc_pidmap(tmp);
-		if (nr < 0)
+		if (IS_ERR_VALUE(nr)) {
+			retval = nr;
 			goto out_free;
+		}
 
 		pid->numbers[i].nr = nr;
 		pid->numbers[i].ns = tmp;
@@ -336,7 +339,6 @@ struct pid *alloc_pid(struct pid_namespa
 	}
 	spin_unlock_irq(&pidmap_lock);
 
-out:
 	return pid;
 
 out_unlock:
@@ -348,8 +350,7 @@ out_free:
 		free_pidmap(pid->numbers + i);
 
 	kmem_cache_free(ns->pid_cachep, pid);
-	pid = NULL;
-	goto out;
+	return ERR_PTR(retval);
 }
 
 void disable_pid_allocation(struct pid_namespace *ns)
diff -druNp --no-dereference linux-libre-3.12.43-gnu/lib/strnlen_user.c linux-libre-3.12.44-gnu/lib/strnlen_user.c
--- linux-libre-3.12.43-gnu/lib/strnlen_user.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/lib/strnlen_user.c	2015-06-10 09:27:29.000000000 -0400
@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const
 			return res + find_zero(data) + 1 - align;
 		}
 		res += sizeof(unsigned long);
-		if (unlikely(max < sizeof(unsigned long)))
+		/* We already handled 'unsigned long' bytes. Did we do it all ? */
+		if (unlikely(max <= sizeof(unsigned long)))
 			break;
 		max -= sizeof(unsigned long);
 		if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
diff -druNp --no-dereference linux-libre-3.12.43-gnu/Makefile linux-libre-3.12.44-gnu/Makefile
--- linux-libre-3.12.43-gnu/Makefile	2015-05-21 09:37:58.000000000 -0400
+++ linux-libre-3.12.44-gnu/Makefile	2015-06-16 04:11:14.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 12
-SUBLEVEL = 43
+SUBLEVEL = 44
 EXTRAVERSION =-gnu
 NAME = One Giant Leap for Frogkind
 
@@ -241,7 +241,7 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
 
 HOSTCC       = gcc
 HOSTCXX      = g++
-HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
+HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu89
 HOSTCXXFLAGS = -O2
 
 # Decide whether to build built-in, modular, or both.
@@ -373,7 +373,9 @@ KBUILD_CFLAGS   := -Wall -Wundef -Wstric
 		   -fno-strict-aliasing -fno-common \
 		   -Werror-implicit-function-declaration \
 		   -Wno-format-security \
-		   -fno-delete-null-pointer-checks
+		   -fno-delete-null-pointer-checks \
+		   -std=gnu89
+
 KBUILD_AFLAGS_KERNEL :=
 KBUILD_CFLAGS_KERNEL :=
 KBUILD_AFLAGS   := -D__ASSEMBLY__
diff -druNp --no-dereference linux-libre-3.12.43-gnu/mm/mempolicy.c linux-libre-3.12.44-gnu/mm/mempolicy.c
--- linux-libre-3.12.43-gnu/mm/mempolicy.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/mm/mempolicy.c	2015-06-10 09:27:29.000000000 -0400
@@ -2576,7 +2576,7 @@ void mpol_free_shared_policy(struct shar
 }
 
 #ifdef CONFIG_NUMA_BALANCING
-static bool __initdata numabalancing_override;
+static int __initdata numabalancing_override;
 
 static void __init check_numabalancing_enable(void)
 {
@@ -2585,9 +2585,14 @@ static void __init check_numabalancing_e
 	if (IS_ENABLED(CONFIG_NUMA_BALANCING_DEFAULT_ENABLED))
 		numabalancing_default = true;
 
-	if (nr_node_ids > 1 && !numabalancing_override) {
-		printk(KERN_INFO "Enabling automatic NUMA balancing. "
-			"Configure with numa_balancing= or sysctl");
+	/* Parsed by setup_numabalancing. override == 1 enables, -1 disables */
+	if (numabalancing_override)
+		set_numabalancing_state(numabalancing_override == 1);
+
+	if (num_online_nodes() > 1 && !numabalancing_override) {
+		printk(KERN_INFO "%s automatic NUMA balancing. "
+			"Configure with numa_balancing= or sysctl",
+			numabalancing_default ? "Enabling" : "Disabling");
 		set_numabalancing_state(numabalancing_default);
 	}
 }
@@ -2597,13 +2602,12 @@ static int __init setup_numabalancing(ch
 	int ret = 0;
 	if (!str)
 		goto out;
-	numabalancing_override = true;
 
 	if (!strcmp(str, "enable")) {
-		set_numabalancing_state(true);
+		numabalancing_override = 1;
 		ret = 1;
 	} else if (!strcmp(str, "disable")) {
-		set_numabalancing_state(false);
+		numabalancing_override = -1;
 		ret = 1;
 	}
 out:
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/bridge/br_multicast.c linux-libre-3.12.44-gnu/net/bridge/br_multicast.c
--- linux-libre-3.12.43-gnu/net/bridge/br_multicast.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/bridge/br_multicast.c	2015-06-10 09:27:29.000000000 -0400
@@ -1058,7 +1058,7 @@ static int br_ip6_multicast_mld2_report(
 
 		err = br_ip6_multicast_add_group(br, port, &grec->grec_mca,
 						 vid);
-		if (!err)
+		if (err)
 			break;
 	}
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/caif/caif_socket.c linux-libre-3.12.44-gnu/net/caif/caif_socket.c
--- linux-libre-3.12.43-gnu/net/caif/caif_socket.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/caif/caif_socket.c	2015-06-10 09:27:29.000000000 -0400
@@ -332,6 +332,10 @@ static long caif_stream_data_wait(struct
 		release_sock(sk);
 		timeo = schedule_timeout(timeo);
 		lock_sock(sk);
+
+		if (sock_flag(sk, SOCK_DEAD))
+			break;
+
 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 	}
 
@@ -376,6 +380,10 @@ static int caif_stream_recvmsg(struct ki
 		struct sk_buff *skb;
 
 		lock_sock(sk);
+		if (sock_flag(sk, SOCK_DEAD)) {
+			err = -ECONNRESET;
+			goto unlock;
+		}
 		skb = skb_dequeue(&sk->sk_receive_queue);
 		caif_check_flow_release(sk);
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/ceph/osd_client.c linux-libre-3.12.44-gnu/net/ceph/osd_client.c
--- linux-libre-3.12.43-gnu/net/ceph/osd_client.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/ceph/osd_client.c	2015-06-10 09:27:29.000000000 -0400
@@ -1709,20 +1709,29 @@ static void kick_requests(struct ceph_os
 		err = __map_request(osdc, req,
 				    force_resend || force_resend_writes);
 		dout("__map_request returned %d\n", err);
-		if (err == 0)
-			continue;  /* no change and no osd was specified */
 		if (err < 0)
 			continue;  /* hrm! */
-		if (req->r_osd == NULL) {
-			dout("tid %llu maps to no valid osd\n", req->r_tid);
-			needmap++;  /* request a newer map */
-			continue;
-		}
+		if (req->r_osd == NULL || err > 0) {
+			if (req->r_osd == NULL) {
+				dout("lingering %p tid %llu maps to no osd\n",
+				     req, req->r_tid);
+				/*
+				 * A homeless lingering request makes
+				 * no sense, as it's job is to keep
+				 * a particular OSD connection open.
+				 * Request a newer map and kick the
+				 * request, knowing that it won't be
+				 * resent until we actually get a map
+				 * that can tell us where to send it.
+				 */
+				needmap++;
+			}
 
-		dout("kicking lingering %p tid %llu osd%d\n", req, req->r_tid,
-		     req->r_osd ? req->r_osd->o_osd : -1);
-		__register_request(osdc, req);
-		__unregister_linger_request(osdc, req);
+			dout("kicking lingering %p tid %llu osd%d\n", req,
+			     req->r_tid, req->r_osd ? req->r_osd->o_osd : -1);
+			__register_request(osdc, req);
+			__unregister_linger_request(osdc, req);
+		}
 	}
 	reset_changed_osds(osdc);
 	mutex_unlock(&osdc->request_mutex);
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/ipv4/route.c linux-libre-3.12.44-gnu/net/ipv4/route.c
--- linux-libre-3.12.43-gnu/net/ipv4/route.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/ipv4/route.c	2015-06-10 09:27:29.000000000 -0400
@@ -921,6 +921,10 @@ static int ip_error(struct sk_buff *skb)
 	bool send;
 	int code;
 
+	/* IP on this device is disabled. */
+	if (!in_dev)
+		goto out;
+
 	net = dev_net(rt->dst.dev);
 	if (!IN_DEV_FORWARD(in_dev)) {
 		switch (rt->dst.error) {
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/ipv4/udp.c linux-libre-3.12.44-gnu/net/ipv4/udp.c
--- linux-libre-3.12.43-gnu/net/ipv4/udp.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/ipv4/udp.c	2015-06-10 09:27:29.000000000 -0400
@@ -1295,10 +1295,8 @@ csum_copy_err:
 	}
 	unlock_sock_fast(sk, slow);
 
-	if (noblock)
-		return -EAGAIN;
-
-	/* starting over for a new packet */
+	/* starting over for a new packet, but check if we need to yield */
+	cond_resched();
 	msg->msg_flags &= ~MSG_TRUNC;
 	goto try_again;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/ipv6/udp.c linux-libre-3.12.44-gnu/net/ipv6/udp.c
--- linux-libre-3.12.43-gnu/net/ipv6/udp.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/ipv6/udp.c	2015-06-10 09:27:29.000000000 -0400
@@ -495,10 +495,8 @@ csum_copy_err:
 	}
 	unlock_sock_fast(sk, slow);
 
-	if (noblock)
-		return -EAGAIN;
-
-	/* starting over for a new packet */
+	/* starting over for a new packet, but check if we need to yield */
+	cond_resched();
 	msg->msg_flags &= ~MSG_TRUNC;
 	goto try_again;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/mac80211/wep.c linux-libre-3.12.44-gnu/net/mac80211/wep.c
--- linux-libre-3.12.43-gnu/net/mac80211/wep.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/mac80211/wep.c	2015-06-10 09:27:29.000000000 -0400
@@ -98,8 +98,7 @@ static u8 *ieee80211_wep_add_iv(struct i
 
 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
-	if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN ||
-		    skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
+	if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
 		return NULL;
 
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -169,6 +168,9 @@ int ieee80211_wep_encrypt(struct ieee802
 	size_t len;
 	u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
 
+	if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN))
+		return -1;
+
 	iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
 	if (!iv)
 		return -1;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/netfilter/nfnetlink_cthelper.c linux-libre-3.12.44-gnu/net/netfilter/nfnetlink_cthelper.c
--- linux-libre-3.12.43-gnu/net/netfilter/nfnetlink_cthelper.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/netfilter/nfnetlink_cthelper.c	2015-06-10 09:27:29.000000000 -0400
@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conn
 	if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
 		return -EINVAL;
 
+	/* Not all fields are initialized so first zero the tuple */
+	memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
+
 	tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
 	tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/sched/sch_api.c linux-libre-3.12.44-gnu/net/sched/sch_api.c
--- linux-libre-3.12.43-gnu/net/sched/sch_api.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/sched/sch_api.c	2015-06-10 09:27:29.000000000 -0400
@@ -804,10 +804,8 @@ static int qdisc_graft(struct net_device
 		if (dev->flags & IFF_UP)
 			dev_deactivate(dev);
 
-		if (new && new->ops->attach) {
-			new->ops->attach(new);
-			num_q = 0;
-		}
+		if (new && new->ops->attach)
+			goto skip;
 
 		for (i = 0; i < num_q; i++) {
 			struct netdev_queue *dev_queue = dev_ingress_queue(dev);
@@ -823,12 +821,16 @@ static int qdisc_graft(struct net_device
 				qdisc_destroy(old);
 		}
 
+skip:
 		if (!ingress) {
 			notify_and_destroy(net, skb, n, classid,
 					   dev->qdisc, new);
 			if (new && !new->ops->attach)
 				atomic_inc(&new->refcnt);
 			dev->qdisc = new ? : &noop_qdisc;
+
+			if (new && new->ops->attach)
+				new->ops->attach(new);
 		} else {
 			notify_and_destroy(net, skb, n, classid, old, new);
 		}
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/socket.c linux-libre-3.12.44-gnu/net/socket.c
--- linux-libre-3.12.43-gnu/net/socket.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/socket.c	2015-06-10 09:27:29.000000000 -0400
@@ -1993,14 +1993,12 @@ static int ___sys_sendmsg(struct socket
 	int err, ctl_len, total_len;
 
 	err = -EFAULT;
-	if (MSG_CMSG_COMPAT & flags) {
-		if (get_compat_msghdr(msg_sys, msg_compat))
-			return -EFAULT;
-	} else {
+	if (MSG_CMSG_COMPAT & flags)
+		err = get_compat_msghdr(msg_sys, msg_compat);
+	else
 		err = copy_msghdr_from_user(msg_sys, msg);
-		if (err)
-			return err;
-	}
+	if (err)
+		return err;
 
 	if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 		err = -EMSGSIZE;
@@ -2205,14 +2203,12 @@ static int ___sys_recvmsg(struct socket
 	struct sockaddr __user *uaddr;
 	int __user *uaddr_len;
 
-	if (MSG_CMSG_COMPAT & flags) {
-		if (get_compat_msghdr(msg_sys, msg_compat))
-			return -EFAULT;
-	} else {
+	if (MSG_CMSG_COMPAT & flags)
+		err = get_compat_msghdr(msg_sys, msg_compat);
+	else
 		err = copy_msghdr_from_user(msg_sys, msg);
-		if (err)
-			return err;
-	}
+	if (err)
+		return err;
 
 	if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 		err = -EMSGSIZE;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/sunrpc/auth_gss/gss_rpc_xdr.c linux-libre-3.12.44-gnu/net/sunrpc/auth_gss/gss_rpc_xdr.c
--- linux-libre-3.12.43-gnu/net/sunrpc/auth_gss/gss_rpc_xdr.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/sunrpc/auth_gss/gss_rpc_xdr.c	2015-06-10 09:27:29.000000000 -0400
@@ -794,20 +794,26 @@ int gssx_dec_accept_sec_context(struct r
 {
 	u32 value_follows;
 	int err;
+	struct page *scratch;
+
+	scratch = alloc_page(GFP_KERNEL);
+	if (!scratch)
+		return -ENOMEM;
+	xdr_set_scratch_buffer(xdr, page_address(scratch), PAGE_SIZE);
 
 	/* res->status */
 	err = gssx_dec_status(xdr, &res->status);
 	if (err)
-		return err;
+		goto out_free;
 
 	/* res->context_handle */
 	err = gssx_dec_bool(xdr, &value_follows);
 	if (err)
-		return err;
+		goto out_free;
 	if (value_follows) {
 		err = gssx_dec_ctx(xdr, res->context_handle);
 		if (err)
-			return err;
+			goto out_free;
 	} else {
 		res->context_handle = NULL;
 	}
@@ -815,11 +821,11 @@ int gssx_dec_accept_sec_context(struct r
 	/* res->output_token */
 	err = gssx_dec_bool(xdr, &value_follows);
 	if (err)
-		return err;
+		goto out_free;
 	if (value_follows) {
 		err = gssx_dec_buffer(xdr, res->output_token);
 		if (err)
-			return err;
+			goto out_free;
 	} else {
 		res->output_token = NULL;
 	}
@@ -827,14 +833,17 @@ int gssx_dec_accept_sec_context(struct r
 	/* res->delegated_cred_handle */
 	err = gssx_dec_bool(xdr, &value_follows);
 	if (err)
-		return err;
+		goto out_free;
 	if (value_follows) {
 		/* we do not support upcall servers sending this data. */
-		return -EINVAL;
+		err = -EINVAL;
+		goto out_free;
 	}
 
 	/* res->options */
 	err = gssx_dec_option_array(xdr, &res->options);
 
+out_free:
+	__free_page(scratch);
 	return err;
 }
diff -druNp --no-dereference linux-libre-3.12.43-gnu/net/unix/af_unix.c linux-libre-3.12.44-gnu/net/unix/af_unix.c
--- linux-libre-3.12.43-gnu/net/unix/af_unix.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/net/unix/af_unix.c	2015-06-10 09:27:29.000000000 -0400
@@ -1891,6 +1891,10 @@ static long unix_stream_data_wait(struct
 		unix_state_unlock(sk);
 		timeo = freezable_schedule_timeout(timeo);
 		unix_state_lock(sk);
+
+		if (sock_flag(sk, SOCK_DEAD))
+			break;
+
 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 	}
 
@@ -1955,6 +1959,10 @@ static int unix_stream_recvmsg(struct ki
 		struct sk_buff *skb, *last;
 
 		unix_state_lock(sk);
+		if (sock_flag(sk, SOCK_DEAD)) {
+			err = -ECONNRESET;
+			goto unlock;
+		}
 		last = skb = skb_peek(&sk->sk_receive_queue);
 again:
 		if (skb == NULL) {
diff -druNp --no-dereference linux-libre-3.12.43-gnu/security/lsm_audit.c linux-libre-3.12.44-gnu/security/lsm_audit.c
--- linux-libre-3.12.43-gnu/security/lsm_audit.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/security/lsm_audit.c	2015-06-10 09:27:29.000000000 -0400
@@ -211,7 +211,7 @@ static inline void print_ipv4_addr(struc
 static void dump_common_audit_data(struct audit_buffer *ab,
 				   struct common_audit_data *a)
 {
-	struct task_struct *tsk = current;
+	char comm[sizeof(current->comm)];
 
 	/*
 	 * To keep stack sizes in check force programers to notice if they
@@ -220,8 +220,8 @@ static void dump_common_audit_data(struc
 	 */
 	BUILD_BUG_ON(sizeof(a->u) > sizeof(void *)*2);
 
-	audit_log_format(ab, " pid=%d comm=", tsk->pid);
-	audit_log_untrustedstring(ab, tsk->comm);
+	audit_log_format(ab, " pid=%d comm=", current->pid);
+	audit_log_untrustedstring(ab, memcpy(comm, current->comm, sizeof(comm)));
 
 	switch (a->type) {
 	case LSM_AUDIT_DATA_NONE:
@@ -276,13 +276,16 @@ static void dump_common_audit_data(struc
 		audit_log_format(ab, " ino=%lu", inode->i_ino);
 		break;
 	}
-	case LSM_AUDIT_DATA_TASK:
-		tsk = a->u.tsk;
+	case LSM_AUDIT_DATA_TASK: {
+		struct task_struct *tsk = a->u.tsk;
 		if (tsk && tsk->pid) {
+			char comm[sizeof(tsk->comm)];
 			audit_log_format(ab, " pid=%d comm=", tsk->pid);
-			audit_log_untrustedstring(ab, tsk->comm);
+			audit_log_untrustedstring(ab,
+			    memcpy(comm, tsk->comm, sizeof(comm)));
 		}
 		break;
+	}
 	case LSM_AUDIT_DATA_NET:
 		if (a->u.net->sk) {
 			struct sock *sk = a->u.net->sk;
diff -druNp --no-dereference linux-libre-3.12.43-gnu/sound/pci/hda/patch_conexant.c linux-libre-3.12.44-gnu/sound/pci/hda/patch_conexant.c
--- linux-libre-3.12.43-gnu/sound/pci/hda/patch_conexant.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/sound/pci/hda/patch_conexant.c	2015-06-10 09:27:29.000000000 -0400
@@ -3575,6 +3575,14 @@ static const struct hda_codec_preset snd
 	  .patch = patch_conexant_auto },
 	{ .id = 0x14f150b9, .name = "CX20665",
 	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f1, .name = "CX20721",
+	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f2, .name = "CX20722",
+	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f3, .name = "CX20723",
+	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f4, .name = "CX20724",
+	  .patch = patch_conexant_auto },
 	{ .id = 0x14f1510f, .name = "CX20751/2",
 	  .patch = patch_conexant_auto },
 	{ .id = 0x14f15110, .name = "CX20751/2",
@@ -3609,6 +3617,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"
 MODULE_ALIAS("snd-hda-codec-id:14f150ac");
 MODULE_ALIAS("snd-hda-codec-id:14f150b8");
 MODULE_ALIAS("snd-hda-codec-id:14f150b9");
+MODULE_ALIAS("snd-hda-codec-id:14f150f1");
+MODULE_ALIAS("snd-hda-codec-id:14f150f2");
+MODULE_ALIAS("snd-hda-codec-id:14f150f3");
+MODULE_ALIAS("snd-hda-codec-id:14f150f4");
 MODULE_ALIAS("snd-hda-codec-id:14f1510f");
 MODULE_ALIAS("snd-hda-codec-id:14f15110");
 MODULE_ALIAS("snd-hda-codec-id:14f15111");
diff -druNp --no-dereference linux-libre-3.12.43-gnu/sound/pci/hda/patch_realtek.c linux-libre-3.12.44-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-3.12.43-gnu/sound/pci/hda/patch_realtek.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/sound/pci/hda/patch_realtek.c	2015-06-10 09:27:29.000000000 -0400
@@ -4142,6 +4142,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+	SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
diff -druNp --no-dereference linux-libre-3.12.43-gnu/sound/soc/codecs/mc13783.c linux-libre-3.12.44-gnu/sound/soc/codecs/mc13783.c
--- linux-libre-3.12.43-gnu/sound/soc/codecs/mc13783.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/sound/soc/codecs/mc13783.c	2015-06-10 09:27:29.000000000 -0400
@@ -603,14 +603,14 @@ static int mc13783_probe(struct snd_soc_
 				AUDIO_SSI_SEL, 0);
 	else
 		mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_CODEC,
-				0, AUDIO_SSI_SEL);
+				AUDIO_SSI_SEL, AUDIO_SSI_SEL);
 
 	if (priv->dac_ssi_port == MC13783_SSI1_PORT)
 		mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC,
 				AUDIO_SSI_SEL, 0);
 	else
 		mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC,
-				0, AUDIO_SSI_SEL);
+				AUDIO_SSI_SEL, AUDIO_SSI_SEL);
 
 	mc13xxx_unlock(priv->mc13xxx);
 
diff -druNp --no-dereference linux-libre-3.12.43-gnu/sound/soc/codecs/wm8960.c linux-libre-3.12.44-gnu/sound/soc/codecs/wm8960.c
--- linux-libre-3.12.43-gnu/sound/soc/codecs/wm8960.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/sound/soc/codecs/wm8960.c	2015-06-10 09:27:29.000000000 -0400
@@ -392,7 +392,7 @@ static const struct snd_soc_dapm_route a
 	{ "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
 	{ "Right Input Mixer", NULL, "RINPUT1", },  /* Really Boost Switch */
 	{ "Right Input Mixer", NULL, "RINPUT2" },
-	{ "Right Input Mixer", NULL, "LINPUT3" },
+	{ "Right Input Mixer", NULL, "RINPUT3" },
 
 	{ "Left ADC", NULL, "Left Input Mixer" },
 	{ "Right ADC", NULL, "Right Input Mixer" },
diff -druNp --no-dereference linux-libre-3.12.43-gnu/sound/soc/codecs/wm8994.c linux-libre-3.12.44-gnu/sound/soc/codecs/wm8994.c
--- linux-libre-3.12.43-gnu/sound/soc/codecs/wm8994.c	2015-05-20 05:15:47.000000000 -0400
+++ linux-libre-3.12.44-gnu/sound/soc/codecs/wm8994.c	2015-06-10 09:27:29.000000000 -0400
@@ -2740,7 +2740,7 @@ static struct {
 };
 
 static int fs_ratios[] = {
-	64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
+	64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
 };
 
 static int bclk_divs[] = {
