--- /dev/null
+From d45b3279a5a2252cafcd665bbf2db8c9b31ef783 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Tue, 8 Jul 2014 12:25:28 +0200
+Subject: block: don't assume last put of shared tags is for the host
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit d45b3279a5a2252cafcd665bbf2db8c9b31ef783 upstream.
+
+There is no inherent reason why the last put of a tag structure must be
+the one for the Scsi_Host, as device model objects can be held for
+arbitrary periods. Merge blk_free_tags and __blk_free_tags into a single
+funtion that just release a references and get rid of the BUG() when the
+host reference wasn't the last.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-tag.c | 33 +++++++--------------------------
+ 1 file changed, 7 insertions(+), 26 deletions(-)
+
+--- a/block/blk-tag.c
++++ b/block/blk-tag.c
+@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struc
+ EXPORT_SYMBOL(blk_queue_find_tag);
+
+ /**
+- * __blk_free_tags - release a given set of tag maintenance info
++ * blk_free_tags - release a given set of tag maintenance info
+ * @bqt: the tag map to free
+ *
+- * Tries to free the specified @bqt. Returns true if it was
+- * actually freed and false if there are still references using it
++ * Drop the reference count on @bqt and frees it when the last reference
++ * is dropped.
+ */
+-static int __blk_free_tags(struct blk_queue_tag *bqt)
++void blk_free_tags(struct blk_queue_tag *bqt)
+ {
+- int retval;
+-
+- retval = atomic_dec_and_test(&bqt->refcnt);
+- if (retval) {
++ if (atomic_dec_and_test(&bqt->refcnt)) {
+ BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
+ bqt->max_depth);
+
+@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_qu
+
+ kfree(bqt);
+ }
+-
+- return retval;
+ }
++EXPORT_SYMBOL(blk_free_tags);
+
+ /**
+ * __blk_queue_free_tags - release tag maintenance info
+@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct reques
+ if (!bqt)
+ return;
+
+- __blk_free_tags(bqt);
++ blk_free_tags(bqt);
+
+ q->queue_tags = NULL;
+ queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
+ }
+
+ /**
+- * blk_free_tags - release a given set of tag maintenance info
+- * @bqt: the tag map to free
+- *
+- * For externally managed @bqt frees the map. Callers of this
+- * function must guarantee to have released all the queues that
+- * might have been using this tag map.
+- */
+-void blk_free_tags(struct blk_queue_tag *bqt)
+-{
+- if (unlikely(!__blk_free_tags(bqt)))
+- BUG();
+-}
+-EXPORT_SYMBOL(blk_free_tags);
+-
+-/**
+ * blk_queue_free_tags - release tag maintenance info
+ * @q: the request queue for the device
+ *
--- /dev/null
+From 3b3a1814d1703027f9867d0f5cbbfaf6c7482474 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 2 Jul 2014 12:46:23 -0400
+Subject: block: provide compat ioctl for BLKZEROOUT
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 3b3a1814d1703027f9867d0f5cbbfaf6c7482474 upstream.
+
+This patch provides the compat BLKZEROOUT ioctl. The argument is a pointer
+to two uint64_t values, so there is no need to translate it.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/compat_ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/block/compat_ioctl.c
++++ b/block/compat_ioctl.c
+@@ -689,6 +689,7 @@ long compat_blkdev_ioctl(struct file *fi
+ case BLKROSET:
+ case BLKDISCARD:
+ case BLKSECDISCARD:
++ case BLKZEROOUT:
+ /*
+ * the ones below are implemented in blkdev_locked_ioctl,
+ * but we call blkdev_ioctl, which gets the lock for us
--- /dev/null
+From 3445857b22eafb70a6ac258979e955b116bfd2c6 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 16 Jun 2014 09:08:29 -0300
+Subject: media: hdpvr: fix two audio bugs
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 3445857b22eafb70a6ac258979e955b116bfd2c6 upstream.
+
+When the audio encoding is changed the driver calls hdpvr_set_audio
+with the current opt->audio_input value. However, that should have
+been opt->audio_input + 1. So changing the audio encoding inadvertently
+changes the input as well. This bug has always been there.
+
+The second bug was introduced in kernel 3.10 and that broke the
+default_audio_input module option handling: the audio encoding was
+never switched to AC3 if default_audio_input was set to 2 (SPDIF input).
+
+In addition, since starting with 3.10 the audio encoding is always set
+at the start the first bug now always happens when the driver is loaded.
+In the past this bug would only surface if the user would change the
+audio encoding after the driver was loaded.
+
+Also fixes a small trivial typo (bufffer -> buffer).
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Scott Doty <scott@corp.sonic.net>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/hdpvr/hdpvr-video.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -81,7 +81,7 @@ static void hdpvr_read_bulk_callback(str
+ }
+
+ /*=========================================================================*/
+-/* bufffer bits */
++/* buffer bits */
+
+ /* function expects dev->io_mutex to be hold by caller */
+ int hdpvr_cancel_queue(struct hdpvr_device *dev)
+@@ -921,7 +921,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl
+ case V4L2_CID_MPEG_AUDIO_ENCODING:
+ if (dev->flags & HDPVR_FLAG_AC3_CAP) {
+ opt->audio_codec = ctrl->val;
+- return hdpvr_set_audio(dev, opt->audio_input,
++ return hdpvr_set_audio(dev, opt->audio_input + 1,
+ opt->audio_codec);
+ }
+ return 0;
+@@ -1191,7 +1191,7 @@ int hdpvr_register_videodev(struct hdpvr
+ v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
+ V4L2_CID_MPEG_AUDIO_ENCODING,
+ ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
+- 0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
++ 0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
+ v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_ENCODING,
+ V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
--- /dev/null
+From db4175ae2095634dbecd4c847da439f9c83e1b3b Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Fri, 4 Jul 2014 05:44:39 -0300
+Subject: media: tda10071: force modulation to QPSK on DVB-S
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit db4175ae2095634dbecd4c847da439f9c83e1b3b upstream.
+
+Only supported modulation for DVB-S is QPSK. Modulation parameter
+contains invalid value for DVB-S on some cases, which leads driver
+refusing tuning attempt. Due to that, hard code modulation to QPSK
+in case of DVB-S.
+
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/tda10071.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -667,6 +667,7 @@ static int tda10071_set_frontend(struct
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ int ret, i;
+ u8 mode, rolloff, pilot, inversion, div;
++ fe_modulation_t modulation;
+
+ dev_dbg(&priv->i2c->dev, "%s: delivery_system=%d modulation=%d " \
+ "frequency=%d symbol_rate=%d inversion=%d pilot=%d " \
+@@ -701,10 +702,13 @@ static int tda10071_set_frontend(struct
+
+ switch (c->delivery_system) {
+ case SYS_DVBS:
++ modulation = QPSK;
+ rolloff = 0;
+ pilot = 2;
+ break;
+ case SYS_DVBS2:
++ modulation = c->modulation;
++
+ switch (c->rolloff) {
+ case ROLLOFF_20:
+ rolloff = 2;
+@@ -749,7 +753,7 @@ static int tda10071_set_frontend(struct
+
+ for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
+ if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
+- c->modulation == TDA10071_MODCOD[i].modulation &&
++ modulation == TDA10071_MODCOD[i].modulation &&
+ c->fec_inner == TDA10071_MODCOD[i].fec) {
+ mode = TDA10071_MODCOD[i].val;
+ dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
--- /dev/null
+media-hdpvr-fix-two-audio-bugs.patch
+media-tda10071-force-modulation-to-qpsk-on-dvb-s.patch
+block-provide-compat-ioctl-for-blkzeroout.patch
+block-don-t-assume-last-put-of-shared-tags-is-for-the-host.patch
--- /dev/null
+media-staging-tighten-omap4iss-dependencies.patch
+media-media-v4l2-core-v4l2-dv-timings.c-cleaning-up-code-wrong-value-used-in-aspect-ratio.patch
+media-hdpvr-fix-two-audio-bugs.patch
+media-tda10071-force-modulation-to-qpsk-on-dvb-s.patch
+nfs-only-show-posix-acls-in-listxattr-if-actually-present.patch
+block-provide-compat-ioctl-for-blkzeroout.patch
+block-don-t-assume-last-put-of-shared-tags-is-for-the-host.patch
--- /dev/null
+media-staging-tighten-omap4iss-dependencies.patch
+media-media-v4l2-core-v4l2-dv-timings.c-cleaning-up-code-wrong-value-used-in-aspect-ratio.patch
+media-af9035-override-tuner-id-when-bad-value-set-into-eeprom.patch
+media-hdpvr-fix-two-audio-bugs.patch
+media-tda10071-force-modulation-to-qpsk-on-dvb-s.patch
+nfs-only-show-posix-acls-in-listxattr-if-actually-present.patch
+xtensa-fix-sysmem-reservation-at-the-end-of-existing-block.patch
+block-provide-compat-ioctl-for-blkzeroout.patch
+block-don-t-assume-last-put-of-shared-tags-is-for-the-host.patch
--- /dev/null
+block-don-t-assume-last-put-of-shared-tags-is-for-the-host.patch